Malicious code in ethers-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4341b184e0a6a60cf305d78f3bb082ad161d36a7de50883afd1cf91e91b56c04 [email protected] impersonates the ethers.js ecosystem name 'ethers-lib', description 'Essential crypto utility library', wildcard dependency on...

MAL-2026-12065 Malicious code in greatcall-customers-commandapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2e378b27f75da210578cf8a4102023d3cbf2ab7e96a97267d73c6ffa15500c9 [email protected] is a dependency-confusion attack package. package.json self-describes as "Dependency confusion PoC" and declare...

MAL-2026-11154 Malicious code in xerohub-discord-voice-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 066cb7d27a71055b89630648ee5ae6eed64d6db93e883de66a5db678cfa7663c xerohub-discord-voice-v2 advertises itself as a Discord voice-channel joiner but its exported startVoiceJoiner flow covertly forwards the caller's...

MAL-2026-5807 Malicious code in sam-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26e593046a8f405a1a571d19aaa6bd46db57c4a22fce4b9acfc114dd4eb8ffb6 [email protected] is a malicious package whose only purpose is to deliver a prompt-injection payload targeting AI coding assistants Copilot, Cursor,...

MAL-2026-4660 Malicious code in react-malicious-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f03498aa5167e02289d4c8984282f6a1b6321af60fb9ff04d0ce9503faefffdd Package name impersonates React and the package.json copies React's description, homepage react.dev, bugs URL, and canary versioning scheme. On...