MAL-2026-13266 Malicious code in devplatform-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from...

Malicious code in devplatform-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from...

Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

Malicious code in sme-foundation-frame-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9bb324a555c0f087f5366e156489724c0b1e06f8b1cdb08032046a0cc1f94d On require/import of the package, index.js unconditionally loads runtime.js, which downloads a platform-specific binary from hardcoded Cloudflare...

Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...

Malicious code in hehehe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 588dd776720f805d7d84a58c93ffcd21ed860e3fc21a48787d732eb6180b974d Package is published as an 'enterprise Windows Diagnostic Utility' but is an anti-proctoring cheating tool that also steals the installer's browser...

MAL-2026-4778 Malicious code in 1cat-tunnel-client-zx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 796f1b18c13a38088b4e48d75575eb92b23af5d91cdfaf6a82717f0fabbc7a79 On npm install, the package's postinstall hook node install.js fetches a platform-specific executable from...

MAL-2026-4677 Malicious code in swift-optimizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c54f35da6df5cef65715d49fb7942aff442ee9a0cb486862031e5009277db3a On npm install, [email protected] runs scripts/install-binary.js as a postinstall hook. The script is a hand-rolled JavaScript bytecode VM 123 KB...

Malicious code in codebuff-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdf777f03e4dc44a9956401136a42f099638025ef7d2197dec630525ad26727d The package name codebuff-cli impersonates the legitimate codebuff npm package; the README is copy-pasted from the official CodebuffAI project it eve...

MAL-2026-4533 Malicious code in codebuff-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdf777f03e4dc44a9956401136a42f099638025ef7d2197dec630525ad26727d The package name codebuff-cli impersonates the legitimate codebuff npm package; the README is copy-pasted from the official CodebuffAI project it eve...

Malicious code in crw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4324181416ad15727c0f51a30b56858c42fad99b93635922494acfe4c0f5d597 Package 'crw' impersonates the Firecrawl SDK: it declares 'firecrawl' as a keyword, replicates Firecrawl's client surface...

MAL-2026-3682 Malicious code in @chahuadev/junk-sweeper-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d446150767f92344d8d0a699f5879bd746200fb8beb60554408699868f03d51 The package's postinstall script package.json line 10: "postinstall": "node install.js" unconditionally fetches a platform-native executable from...