MAL-2026-11002 Malicious code in habinger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5 The package's postinstall hook package.json postinstall: node test.js auto-executes two malicious flows on npm install. First, on Linux it fetches an...

MAL-2026-6317 Malicious code in ts-bn-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e591f0b407bc22e3abe20da9207df2d2922f75d98ab97aaa62557ca88b8fc349 [email protected] is a credential harvester disguised as a TypeScript/lint utility. index.js defines decodeStr which base64-decodes all operationally...

Malicious code in solana-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 059c5a74392811a397d3868092b7bcc84fbfac9d2f3de1c69a6421cdf756b652 On npm install, the package's postinstall hook node install.js executes a multi-stage attack against the installer's machine. It reads...