5 matches found
MAL-2026-12124 Malicious code in @zzzgenesis00/tronweb3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...
Malicious code in @wethenorth12/env-loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de45cab34c84d02c802689caf5a6683df75d402bb17239fea95b395860942ac9 On require, index.js reads the full process.env map along with hostname, username, homedir, platform, and cwd, JSON-stringifies and base64-encodes th...
MAL-2026-10442 Malicious code in @oliviamcdaniel12/safer-buffer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f Package impersonates the popular safer-buffer module. On require, safer.js reads a PID from Porting-Buffer.md and, if that process is not alive, spaw...
Malicious code in wallet-agent-ai-radix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a953d7785091650f4f48e0b038e71ad79788102ffd652bff4bb0e8bf40ea21 dist/agent.js contains a hardcoded Telegram Bot API endpoint https://api.telegram.org reached via fetch with a POST body that includes values from...
