Malicious code in aria-live-region-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391a9a163273e36e3945f918ea720b8e10aa462b0aa603d4012b28c557c58570 The package is advertised as an ARIA accessibility helper but ships thunderboltRegistry.js, which executes a top-level IIFE on module load. The IIFE...

Malicious code in css-dwsawd-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c370cda09695e44d06a44bc14d14817edadc047e4dad0314edcfc752be796e9 The package name mimics a Wix thunderbolt polyfill and ships a registry-manifest.min.json that aliases legitimate @wix thunderbolt registry module...

MAL-2026-17550 Malicious code in css-dwsawd-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c370cda09695e44d06a44bc14d14817edadc047e4dad0314edcfc752be796e9 The package name mimics a Wix thunderbolt polyfill and ships a registry-manifest.min.json that aliases legitimate @wix thunderbolt registry module...

MAL-2026-13872 Malicious code in @years17/n8n-nodes-utils-helper-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 983dd9c9e4907f30015aa86aceae1cc95f5511f3de89eadb7b8550a1485c7d24 The package registers a postinstall script also duplicated as the main entry that runs shell reconnaissance on the installer host — id, hostname,...

Malicious code in antsrcsrctest (npm)

The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....