MAL-2026-12880 Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

MAL-2026-10605 Malicious code in @radivi-ui/react-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e92ae03eb6adb090fb832665431984cccef31039bb920e3850535f4defe610 @radivi-ui/react-dialog is a typosquat of @radix-ui/react-dialog whose main entry index.js is a self-executing IIFE that runs whoami and hostname via...

Malicious code in chai-as-polished (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2ea0d46e0bb4382e8d684d025cb72b7f99e37874c571e9946ae1268b70be6cf Package name is a one-edit typosquat of the widely-used chai-as-promised, but the shipped code is unrelated to chai. The exported middleware spawns a...

Malicious code in getd-eslint-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17328047b2ec8dce82cfbdfd5b16c8f862d51dca26b02c9801587c220a48975a On npm install, postinstall.js collects host identifiers os.hostname, os.userInfo username, os.platform, current working directory, CI environment...

Malicious code in gethandler-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b6925d4c07df297f8cb573df4d85a396794d8793179e7a97f2cfde3aadfcfbc On npm install, postinstall.js unconditionally sends an HTTPS GET to https://webhook.site/18dc4281-d366-438a-9186-76fbcd56ade5 carrying the installer...

Malicious code in nvidia-nat-semantic-kernel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe66a4b0f7f00b8e8a9abd877b3ab0531d56906cc11f6fa6ecaddd4b0bebbbe1 The package's METADATA declares Requires-Dist: ruamel-yaml-clibz==0.3.5, a typosquat of the well-known ruamel-yaml-clib note the trailing 'z'...