MAL-2026-13616 Malicious code in hardhat-cap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8 The package is published as hardhat-cap but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger,...

Malicious code in bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339 On module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob,...

MAL-2026-13257 Malicious code in bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339 On module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob,...

MAL-2026-13195 Malicious code in dolyame-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c23ba8923130746ecc1e526c3a0ee8961ea764dd90d0da71236444d978ce27 dolyame-ui-themes ships a loader.js that is required from the package main index.js at module load. The loader reconstructs C2 hostnames from split...

Malicious code in bnpl-blocks-atom-bnpl-link-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be43998de08cea356c696d856d5469ab529293a1899f1beed856d529200413d On require of the package, index.js loads polyfill.js which selects a platform-specific path, downloads an opaque binary over HTTPS from hardcoded...

Malicious code in checkout-mobile-total (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1943ab64ce84576c6fef87d3b46187d0e442941f691d645adfe5f73595cfe9a On require of the package, index.js unconditionally loads vendor.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12580 Malicious code in checkout-mobile-total (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1943ab64ce84576c6fef87d3b46187d0e442941f691d645adfe5f73595cfe9a On require of the package, index.js unconditionally loads vendor.js, which fetches a platform-specific binary from hardcoded Cloudflare Workers hosts...

Malicious code in devplatform-eslint-plugin-nx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35adb61664d8a7067c4ace2c143ed75e5e316dcd5365201ac8614ef9ff07e668 [email protected] is a typosquat lure targeting @nx/eslint-plugin. On require of the package, index.js loads runtime.js which...

Malicious code in twilio-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea71d301e90ede6f86f259e827a1cb61ad0b4b0166b70281bdf7896f726eea31 On npm install, the package's postinstall script executes index.js, which collects host identifiers os.hostname, os.userInfo.username, os.homedir,...

MAL-2026-12813 Malicious code in twilio-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea71d301e90ede6f86f259e827a1cb61ad0b4b0166b70281bdf7896f726eea31 On npm install, the package's postinstall script executes index.js, which collects host identifiers os.hostname, os.userInfo.username, os.homedir,...

Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

MAL-2026-12370 Malicious code in eslint-plugin-vitest-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354edd3ce58afcb537f1e58b5152244cc6a98c6b0462de297262d9aba4e17d3 The package declares itself as an ESLint plugin but ships copies of nodemailer's source layout along with an obfuscated install-time loader...

Malicious code in @wethenorth12/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f602036ff9f524298056528fbec6c58c9fb66ea2686bec418694b5854aeea4 On require, index.js collects the full process.env object together with hostname, username, home directory, platform, current working directory, and ...

MAL-2026-12088 Malicious code in @wethenorth12/bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f602036ff9f524298056528fbec6c58c9fb66ea2686bec418694b5854aeea4 On require, index.js collects the full process.env object together with hostname, username, home directory, platform, current working directory, and ...

Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

MAL-2026-12074 Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcb1561dd1153104da17218a74c318e8d497b4df1429bbbda8cda0144bd06ce On require of the package's main entry, index.js transitively loads platform.js, which selects a platform-specific payload URL, fetches opaque...

MAL-2026-10683 Malicious code in formatters.ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21827129edc8dbde114c615df656d5a234d1fbcfa5b9f63d5286d781253e8f2b The package declares a preinstall hook that runs index.js on npm install. index.js collects host and identity reconnaissance — os.hostname,...

MAL-2026-10594 Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

MAL-2026-10463 Malicious code in node-path-addon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dbc52a88818bccd5602eb556ea4bf089dac66c44a2bb1ecbd6fddd6723e9d1d node-path-addon presents itself as an extension of the Node.js built-in 'path' module. Its main entry path.js delegates by executing...