Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

MAL-2026-15565 Malicious code in @testrelic/playwright-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c305bbe247587c98b06f039cdcf78066dbcd4fdacf5a5de0411023c2a4fcc97a scripts/postinstall.cjs is registered as the package's postinstall lifecycle script and runs automatically on npm install. After a block of...

Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

Malicious code in es6-migrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8 The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields hostname, ...

MAL-2026-15553 Malicious code in es6-migrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daeec82833ba2519ba974153de0fb545f6b5c088ed2a8145680ede73c5b0b9b8 The package's declared preinstall script runs beacon.js on npm install. The beacon unconditionally collects installer-side identity fields hostname, ...

Malicious code in confluence-create-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011485304eea045bddd134da5fdabfcf9d96acd0f2c78e1800a4c32674a5788c package.json declares a dependency whose key equals the package's own name confluence-create-content and whose value is a bare HTTPS URL,...

MAL-2026-15532 Malicious code in confluence-rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d314e75faa527b1c10dbc34b2867180fb0726f2547d9b0edd0564aec3e38fd8 package.json declares a self-referential dependency whose key equals the package's own name confluence-rest and whose value is the bare HTTPS URL...

Malicious code in prm-bundles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e252184c7a4f29eafe72c86873c662342486b68fe5c1ce3a5405845aa8695a33 package.json line 11 declares a dependency whose key equals the package's own name prm-bundles and whose value is a bare HTTPS URL...

Malicious code in ir-annuities-client-authentication-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d813fc9c0831847a602c97803b7e53603edfb6acef4386e4cde2927c2a7a297 package.json declares a dependency whose key equals the package's own name ir-annuities-client-authentication-module and whose value is a plain HTTPS...

MAL-2026-15539 Malicious code in loading-performance-instrumentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dab9307010475c57195f838ba7d7299fe4a753b92926536aa8376f8d096150 package.json line 11 declares a dependency whose source is a bare URL rather than a registry version range: "loading-performance-instrumentation":...

MAL-2026-15546 Malicious code in vui-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0411fd70c7f76d71355fcd1ab650dac43afefc55b802d86ad4755b06456bb1ad package.json declares a dependency whose key equals this package's own name vui-gateway and whose source is an off-registry HTTPS URL,...

Malicious code in gridster-coords (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245882b881fde3396fcb6e1e14f8b0014fc64cd1d02d27f101c8fd2a0b16c944 package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridster-coords instead of a...

Malicious code in framework-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...

Malicious code in katal-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ff7c110d8766d130db16799f1875e420bdaba20866624b593a209ace7a49d6a package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/katal-logger instead of a registry version range. On...

Malicious code in calcite-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91223994e8bb4e46e1b3ca5eea1714a25fedbb828090590110f8c23353c6ec17 package.json at line 11 declares the package's own name as a dependency whose source is the bare URL https://repo.securityctrl.com/calcite-web instea...

MAL-2026-15499 Malicious code in calcite-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91223994e8bb4e46e1b3ca5eea1714a25fedbb828090590110f8c23353c6ec17 package.json at line 11 declares the package's own name as a dependency whose source is the bare URL https://repo.securityctrl.com/calcite-web instea...

Malicious code in tabbables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb package.json at line 11 declares a dependency whose key equals the package's own name tabbables and whose value is the raw HTTPS URL...

Malicious code in jsb-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368bba2e9d134a0d1ce565627644361ebe98bbf7bc2fd04812ff7137c300eaac package.json declares a dependency whose key jsb-adapter equals this package's own name and whose value is the bare HTTPS URL...

MAL-2026-15517 Malicious code in one-intuit-help-system-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c22e9eaa97b1ee548e6ca6ac6257ea72fed0ee92d5b54255781e62b8ae19783 package.json declares a dependency whose key equals the package's own name one-intuit-help-system-utils and whose value is a bare HTTPS URL...

MAL-2026-15515 Malicious code in npm-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a6c4f2b94932e8bcb68c0a146d536b7e3a00d48041aa5a6fc9edf9f82ae5244 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/npm-extension rather than a registry version range. ...