Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

MAL-2026-16154 Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

Malicious code in date-fns-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9839e9520db45a2a739a415767a8258e15afee65cee71fe5ff41777cbd22450 The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate shim as a decoy in front o...

MAL-2026-15974 Malicious code in date-fns-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9839e9520db45a2a739a415767a8258e15afee65cee71fe5ff41777cbd22450 The package impersonates the popular date-fns library. Its main module, date-fns-formatter.js, contains a small formatDate shim as a decoy in front o...

Malicious code in @ghost_debugger/nanocache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c027fa29f4577bd052bfda553a617994365ea5855216b877e900610542f4bcce On require/import, the package spawns a bundled 1.1 MB Windows executable at vendor/nanocache.exe as a detached background process with stdio ignored...

Malicious code in js-logger-pack (npm)

js-logger-pack is a fake npm logger that the attacker developed openly on the registry over 23 versions across two weeks 2026-04-01 to 2026-04-15. Version 1.1.20, published hours after initial detection, is a re-obfuscation of the same payload with a new hash — same C2, same capabilities. Early...