Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

MAL-2026-10931 Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10932 Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10948 Malicious code in @akrai/report_new (npm)

The @akrai/reportnew package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

MAL-2026-11043 Malicious code in supplyhub (npm)

The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...

MAL-2026-10935 Malicious code in twilio-platform-async-data-fetch (npm)

The twilio-platform-async-data-fetch package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10938 Malicious code in twiliointernal-messaging-toolbox (npm)

The twiliointernal-messaging-toolbox package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10740 Malicious code in myreviews-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c41d5d4352e265f0efbc0089a19c5773ceeb76c0265831eeeeca19151fe4f64 package.json declares a postinstall lifecycle hook that runs node -e to issue an HTTPS GET to a hardcoded webhook.site collector URL, appending the...

MAL-2026-10675 Malicious code in ac-raf-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9d9e454c08fdafa531ee74a3bc52513d5bc39413810db4a6371494872984f8 package.json declares a preinstall lifecycle script that runs curl -X POST against a hardcoded webhook.site collector URL...

MAL-2026-10634 Malicious code in estore-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...

MAL-2026-10212 Malicious code in vuln-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8bd105bf3b12062f312b41f2a1eead5e8481f8d3749fc78bc79ed8675c11394 On npm install, the package's preinstall script triggers a DNS lookup to a unique subdomain of oast.fun fabekzbnjtufpffkzzmvjvi5eafhny3ok.oast.fun, a...

MAL-2026-10208 Malicious code in @meziizana/frontend-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7d77255cb713e19b9560cc339e937518fdbfb49ab048d9d5a65ad81c1309a9a package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/f164a383-b9e7-4379-b18c-38bf41a3c152/ with query...

Malicious code in polipoli-pak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8693677ff1f1f887c11d3b4f6ad3f1742c7eefd07b6b8cfabd6cfccc32bc48f On npm install, postinstall.js runs automatically and performs two unauthorized actions against the installer. First, it POSTs a JSON fingerprint of...

MAL-2026-10099 Malicious code in polipoli-pak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8693677ff1f1f887c11d3b4f6ad3f1742c7eefd07b6b8cfabd6cfccc32bc48f On npm install, postinstall.js runs automatically and performs two unauthorized actions against the installer. First, it POSTs a JSON fingerprint of...

MAL-2026-7018 Malicious code in n8n-nodes-barcode-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb55ae2b864b933ae071cb33e8f53a52005ff0dc26487d15639f3b07fa7d9849 The package presents itself as an n8n community node for barcode generation, but dist/credentials/BarcodeGeneratorApi.credentials.js contains a...

MAL-2026-7004 Malicious code in thunder-rony (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b49da9c4d3522da30e4c917c3102444f9d61d3ab3e9c547b74b9240168754b9a On npm install, the package's postinstall hook executes index.js, which collects the installer's OS username os.userInfo.username, hostname...

MAL-2026-7002 Malicious code in ronyfortest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c9f63368f7e1147ade261a87f45e32e13bcf79b5336efad59087ce85e64a849 The package's postinstall hook node index.js runs automatically on npm install and collects the installer's OS username os.userInfo.username, hostnam...

MAL-2026-5987 Malicious code in ogd-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1df5f4bdd6e2f58ff581cbad0d01738b5f6464794ace1a9fa95eea061a5bb7d5 package.json declares a preinstall lifecycle script that runs automatically during npm install. The script executes hostname, whoami, and pwd, then...

MAL-2026-10600 Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...