MAL-2026-13800 Malicious code in cvvkshuelwiu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de3f325329894b841474989d30370570a7f1b68d02334db1b98dcaf109899fa9 Package [email protected] contains 2 files with no a static rule matches and no traced behaviors of concern. No install-time scripts, network...

Malicious code in mnzjgxciwadk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cccb5ec6b21fbd7d0b720bf6dd7257a5b6e0e9428fe55d8197fccec53c79a662 The package contains a single file, index.html, which is also declared as the package main. The HTML presents a Cloudflare Turnstile-styled challenge...

MAL-2026-13784 Malicious code in bgncvhferucfds (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1bf8639ccc5d2a70ae2e0ce754b76e1ca525699413f5d696289714005e86c57 The package's sole content is a single obfuscated HTML file declared as main. When loaded in a browser, the page renders a fake Cloudflare Turnstile...

Malicious code in clxofwfjskaz7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b4dde997a29794d4dfbb4725da833fa7cb4a221dc91d6b820901745eb77f198 The tarball contains only package.json and index.html. package.json declares main: index.html and no lifecycle scripts...

Malicious code in vkldhcmieru6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25890a37fa8da48d2dc2868e010cef8cb3427faa42218cec4b858ac82db679d7 The package contains only index.html declared as main in package.json and a minimal package.json with no lifecycle scripts. The HTML impersonates a...

MAL-2026-13830 Malicious code in nihzvdeowx5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 303f930ccf841284aaa263af6244d308d3bfd0d83b5af6ae037ff634f2518d94 The package contains only index.html declared as main in package.json and no JavaScript entry point, lifecycle scripts, or other module code. The HTM...

MAL-2026-13807 Malicious code in fdhcvriwecv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72894ed6ed82e4ebcbd83619b2a3f591c7dab355050fc1d43a62f90d384ee08 The tarball contains only package.json and index.html. package.json declares main as index.html, and there are no...

MAL-2026-13809 Malicious code in fhj8cv9dkwm4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91ea4120fcb82c9a36d533346c28a2ce7ed225ed31a89526d9cee45f0be2581 Package ships a single index.html that mimics a Cloudflare Turnstile 'Just a moment...' verification page. An obfuscated obfuscator.io-style script...

MAL-2026-13834 Malicious code in thundertiger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1c287b2a6653cf3abb51d22059dbe433959b3a2445a75f32e27ed029b1e42d7 The package's only shipped content is a single HTML file that mimics a Cloudflare 'Just a moment...' security challenge. The inline script is...

Malicious code in thundertiger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1c287b2a6653cf3abb51d22059dbe433959b3a2445a75f32e27ed029b1e42d7 The package's only shipped content is a single HTML file that mimics a Cloudflare 'Just a moment...' security challenge. The inline script is...

MAL-2026-13829 Malicious code in nhdxzthponv5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6436b46b4e05feabab19a551bd470495e4d8fc9dfef7e42a01bd527054b1b07d Package [email protected] has a random name, no description/author/repo/dependencies/lifecycle scripts, and its 'main' points at index.html with...

MAL-2026-13828 Malicious code in ms_aidc_com_tw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12bdd45f103beeee602be82a07277a3f0cb842ec3a9829e904911fe37bd2fd5 The package msaidccomtw ships only an index.html that renders a fake Cloudflare Turnstile 'security verification' page. On Turnstile completion,...

MAL-2026-13789 Malicious code in bmgki3g6fh3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9212dc22bc5983b7b163b7851e76596bda812485709581a8dd61475630db4450 The package contains a single file, index.html, declared as main. The page renders a spoofed Cloudflare 'Just a moment...' / Turnstile 'security...

Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

MAL-2026-13778 Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

MAL-2026-13933 Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

Malicious code in sui-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11a215fced265f75473130d499c7d6ea6097f63aa19c595fc5445a56633b1c6e On require'sui-bcs-codec', a hidden IIFE labeled 'compat-probe' in index.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, and.env files under cwd...

MAL-2026-13767 Malicious code in sui-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11a215fced265f75473130d499c7d6ea6097f63aa19c595fc5445a56633b1c6e On require'sui-bcs-codec', a hidden IIFE labeled 'compat-probe' in index.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, and.env files under cwd...

Malicious code in base65-11x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cc9506a804a2663d0cde1c610fa8cba5733e6797652b6365569ada5ef3901d base65-11x is a name-lookalike of the widely used base-x encoder. Both entrypoints src/cjs/index.cjs and src/esm/index.js, 127KB each vs. 4KB for rea...