MAL-2026-16349 Malicious code in hardhat-devkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcb676af47bf26017d1fbc2cf63aae76d09e9248e860f6d0e86d57da92d2b95 Package published as hardhat-devkit presents itself as an Ethereum/Hardhat developer toolkit, but the shipped surface is a cover story: README,...

Malicious code in sme-rko-finance-front-operations-income (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...

MAL-2026-13335 Malicious code in dolyame-boxy-independent-bnpl-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3490fd11839adb1f5027facaf8046cd19e640fffdbf79d0684c91a565dd8303 On require of the package's main entry, index.js loads adapter.js which performs OS/arch detection and fetches an opaque binary from...

Malicious code in dolyame-ui-notification (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27d450fda6c199002bb4eb20b3bf624e31393ae3ed30e9a36fce17507472b962 Package advertises itself as a UI notification toolkit but its main entry requires./compat.js, which on load randomly selects a destination from four...

MAL-2026-12841 Malicious code in bigops-telephony-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98fd12faa59a5e65d0383cfb3be55ccd49beca5c74cb350b62f5717be83bcd65 On require of bigops-telephony-client, index.js loads./runtime.js, which unconditionally downloads a platform-specific binary over HTTPS from...

MAL-2026-12889 Malicious code in bnpl-blocks-atom-bnpl-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1d5c6a3a1bb7d8a26a77aada7abbec439922ebceec32b8608909ad2ee8acac On require of index.js, shim.js executes immediately and fetches an opaque binary from one of three string-concatenation-obfuscated origins...

Malicious code in bpm-renovate-renovate-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2fc5b92d1c0023e38459ab9285d928b6fbe3124bfda9d4d6b055dd1fe0bf4e On require, index.js loads setup.js which downloads a platform-specific binary over HTTPS from one of four string-concatenation-obfuscated .workers.d...

MAL-2026-12567 Malicious code in checkout-input-card-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cc552600295f6b008943a756a1cf29218d2e6d93a40dd72ea4cd06f039f80cb On require of the package, index.js loads vendor.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

MAL-2026-11499 Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

MAL-2026-11042 Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

MAL-2026-11044 Malicious code in tailwind-gutenberg-block-zero (npm)

The npm package tailwind-gutenberg-block-zero is a supply-chain dropper disguised as a WordPress / Gutenberg block plugin. The published tarball carries the trappings of a real plugin a my-tailwind-blocks.php, a wp-scripts build configuration, a README and a screenshot, but its real behaviour liv...

Malicious code in sync-grove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65248cd6e2924b6485824bcf382441e39d5e09860bc1e849aee0d6d289d184fb Package.json declares "postinstall": "node setup.js", so setup.js runs automatically on npm install. The script assembles the strings shelljs and exe...

MAL-2026-10749 Malicious code in sync-grove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65248cd6e2924b6485824bcf382441e39d5e09860bc1e849aee0d6d289d184fb Package.json declares "postinstall": "node setup.js", so setup.js runs automatically on npm install. The script assembles the strings shelljs and exe...

Malicious code in assertcoreutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e53b085bfe045b4aeabe9ad77e1066ab0883f27304197377681191c3118b780 assertcoreutils impersonates the popular chai assertion library: the README, the chai keyword, the lib/chai/ directory layout, and lib/chai.js are...

MAL-2026-10491 Malicious code in assertcoreutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e53b085bfe045b4aeabe9ad77e1066ab0883f27304197377681191c3118b780 assertcoreutils impersonates the popular chai assertion library: the README, the chai keyword, the lib/chai/ directory layout, and lib/chai.js are...

MAL-2026-6999 Malicious code in luludawang-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae96a2ee83d724de0e046dbf9e4749e9fd0d5c56fc16f2f28050512080f30628 On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL...

Malicious code in datefmt-helper (npm)

The npm package datefmt-helper is a supply-chain dropper disguised as a benign date-formatting utility its description reads "dates formatting utility with locale support". The package ships no source repository and places its real behaviour in an install script. A postinstall lifecycle hook...

MAL-2026-6465 Malicious code in chai-as-built (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 469c5ebe97d1e69d080295000d723febbb06050f65aed9a0f44a76fd707c0b1e chai-as-built masquerades as the pino logger package.json keywords 'fast','logger','stream','json'; file layout lib/proto.js, lib/redaction.js,...

Malicious code in chai-as-built (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 469c5ebe97d1e69d080295000d723febbb06050f65aed9a0f44a76fd707c0b1e chai-as-built masquerades as the pino logger package.json keywords 'fast','logger','stream','json'; file layout lib/proto.js, lib/redaction.js,...