MAL-2026-13974 Malicious code in @khaznatech/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 820c7f4f32895ef501e6926f624897cf41b5f868bc21c60852cbfc101b4cd5ba The package ships install-report.js as a preinstall lifecycle script that unconditionally runs on npm install. The script reads os.hostname and the...

MAL-2026-10086 Malicious code in dl-pp-latm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e21f1adb71c41838848c4d4292830a9738895d32a5b0f1f098e1efdadb233716 Package [email protected] registers both preinstall and postinstall lifecycle hooks that run index.js, which collects installer machine identifiers —...