Malicious code in w-mousekey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90980104a84f52c4a98cc74642b9ff7a6c0556771e20b6f6eaeb96eb876cd979 Analysis of [email protected] produced no indicators of installer-side harm. No install-time or import-time execution of attacker-controlled code, no...

Malicious code in jshelperdependenceny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9 npm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 packag...

Malicious code in @fmr-ap153177/apex-kit-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz...

Malicious code in @generic-means/ing-feat-scanner-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7053eaf141232704108519a3b3e7a0f1197d9eaabfa9fd3f4ff56ae9f753d763 package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.3.tgz...

Malicious code in @factoryz/apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad The package ships only an empty stub module.exports = and a manifest whose sole dependency ltidisafe is resolved from a hardcoded off-registry HTTPS...

Malicious code in @jm-telefonica/multibrand-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ef565c5fd4b4baa7e0bff888cf34107fa8a9385932195fa4fd90ad39f250927 package.json at line 9 declares the sole dependency ltidisafe as a direct HTTPS tarball URL...

Malicious code in @postex/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fb98ad3575267cc8fbf617fe6a17000ed10df97d39710f4b7aaddf7225598d7 @postex/[email protected] ships an inert index.js module.exports = and declares a single dependency ltidisafe whose value is a bare HTTPS tarball URL...

Malicious code in sc-hydrate-carousel-price (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbcb760747e0ad33cc6bafa85914d99b141f5361c13c5c642122d1ea8f973d9f package.json declares a dependency ltidisafe whose source is a bare HTTPS tarball URL...

Malicious code in @futurae-public/adaptive-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18526e44113025f1e08a31eb237515c63ae912a6cfe82bec37c14895f4f23178 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.2.tgz...

Malicious code in paychex-pdftron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3 [email protected] ships an empty stub module.exports = and declares its sole dependency ltidisafe as a bare HTTPS tarball URL...

Malicious code in @ppa-web-components/ppa-headerfooter (npm)

@ppa-web-components/ppa-headerfooter is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.0, 2.0.1, 2.0.0, 1.0.1, 99.0.1, 3.0.0 has a postinstall scri...

Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

@ppa-web-components/ppa-hotel-collection is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.1.0, 1.0.0, 99.0.1, 2.0.1, 3.0.0 has a postinstall script...

Malicious code in @ppa-web-components/ppa-banner (npm)

@ppa-web-components/ppa-banner is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.1, 2.0.0, 1.1.0, 0.0.1, 2.0.1, 1.0.0 has a postinstall scri...

Malicious code in @ppa-web-components/ppa-builder (npm)

@ppa-web-components/ppa-builder is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 99.0.1, 2.0.1, 3.0.0 has a postinstall script th...

Malicious code in @ppa-web-components/ppa-searchform (npm)

@ppa-web-components/ppa-searchform is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.0, 1.0.1, 2.0.1, 0.0.1, 3.0.0, 1.1.0, 99.0.1, 2.0.0 has a...

Malicious code in @ppa-web-components/ppa-navigation (npm)

@ppa-web-components/ppa-navigation is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.1, 1.0.0, 2.0.0, 99.0.1, 3.0.0, 2.0.1 has a postinstall script...

Malicious code in fontus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5b8b4484126f787f9917d91b6815927146a308f64bfb852c57f5d60bf4bfbb Analysis of fontus 0.0.3 on PyPI did not identify any code paths that exfiltrate installer data, execute attacker-controlled payloads at install or...

Malicious code in tiktok-video-scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef8afdfd46def73ea112fa0024f94e41f206305cf9334662735958c05ccfe99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in insta-reel-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc584c5e885d66c7d3e895a467192ddd7a40082a2fe2df9ad45d8835ba65c4e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ionic-tiktok-scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81665bdc2eec89b96d3b0ce247657c1ad75f497503347b8c35c65d324e99a389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ionic-sound-cloud-loader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1fdd1acea61b27d664ac4012dcc63f8a5525fe7893a3f012b8a04bf00596b33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sound-cloud-loader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fd8d35927bc622270dcca94349a58c1f9daf31ebeb6bd4c8fc784cd140cc263 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in insta-api-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a09908a36abda4fcde37ed9dd87c26112044394f1775f742cd56ca16ec6e6cea The package wraps Instagram login/API operations and performs two installer-harming behaviors against a hardcoded author endpoint at...

Malicious code in ionic-insta-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 407c310ce45465666130259c09efcd3fbcb31a3d0173587bd2c4db6a078cc70a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ionic-youtube-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c551ccf6ad7f2689c8e83cd054ea50278c224f50d1f37dc0285a3da31331dbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ionic-youtube-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c081308db3c1e903e04a99672621d70a549e82da4baa7e7624d3960048d93e63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in appit-cordova-admob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c43e8d1cd94e817a763aa22f3edb86e232a3c4ca467af0c8d77cda9b3b03c3d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cordova-plugin-geofence-appit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d6df6a389ad760629032dd0d4208662693ac60ebca2ff2b53ffbdf5f464387a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in appit-cordova-plugin-ionic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ca4bb7b12ff9e72819f551c8252a855a7500368c07445e10661aa67cd7792c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ocsp-hashes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5167b67fd13cd4c8c6f63298909e9e4b532cae03035e5158629eaaa355cc540 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in youtube-info-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d38f2ba6def3a037f621b617a0823144c52043e6adc1b22f2e81eb7aafc5ae11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redis-dumper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c3ee8b960cc4d59eff195c1ddc79224b61178479a16026c47dc5cb79cb93cbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in youtube-search-without-api-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64255a9b30bfd083ac86612f2d7307de45dc83a57c42caf459cfb8df21dc2bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in p12-pem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c50c1679b0617ad231d0e8aaf2c111ab57f909dff3af9e1b628169aba167381 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cert-infos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9c8351a95953b95817bd6cc206618cfb83676e664b8ea2d67035b17ddb21079 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @eforms/forms-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e58d3810346fb211fd7ed78e8df88c774a79bb079537e10cd30baa26e5ef4740 The npm package @eforms/[email protected] is a scoped-name dependency-confusion lure with an inflated version number and an empty index.js stub. Its...

Malicious code in @drone-js-ext/core (npm)

@drone-js-ext/core is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 1.0.0, 2.0.1, 3.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry install...

Malicious code in @drone-js-ext/vip-badge (npm)

@drone-js-ext/vip-badge is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 0.0.1, 1.0.1, 2.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry...

Malicious code in tailwind-base-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8028e80925294f77a399eab9c3d9402ecaa7b191df72c75c437e9f03979ebdb Package [email protected] is a small npm package with 6 files. No install-time or import-time execution of attacker-controlled code was...

Malicious code in tailwindcss-theme-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c828df38cf23c0b9deb4ee3d705c8dd3fe5ab0f92d426fe56f6b3301e38473c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in noelc-css-blender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1af88de104874d73dc5e8853fec7d4ca8b0c2c1dfa26a3cff9e44fac7eb30ea6 [email protected] declares itself as a 'tiny ESM utility for blending CSS custom-property token maps' with zero dependencies, but ships two...

Malicious code in overarch-windows-x64-yr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4f6ee7ce14b6f82693df259b2b80baab736299f888037a09941b95b73780247 The package [email protected] contains six files and no behaviors were identified that read installer secrets, fetch and execute remote...

Malicious code in @liauto/win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a07571659f87c556108cf21bc4ef2526b864c43ad5580c813d2bfcb3963d5511 This is a platform-specific npm package win32-x64 variant with a small shipped surface 2 files. No install-time lifecycle execution, no outbound...

Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d737b7390bb1f6e91bafe18d3f037a410e18607f3e60e1a92b24f81ccea890ed @k18k/entrypoint-sdk-darwin-arm64 is a platform-specific native artifact package darwin-arm64 variant typical of the optionalDependencies pattern use...

Malicious code in orqiva-runtime-win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8ce12f6f6bb365ec17d64617f49a5aa08342ed91ed2ced13af4990f8accfdc This package follows the naming convention of a platform-specific prebuilt binary distribution win32-x64 suffix, commonly used by Node tooling to shi...

Malicious code in @k18k/entrypoint-sdk-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daa27c796b86115cf9b0b7113f614ec7e53edb15e4b03b2ec52c10b4a2fb23a2 Package @k18k/[email protected] is a linux-x64 platform-specific companion artifact, consistent with the common npm pattern of...

Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd94f9aefc7090d1260bb8123fd1bd78f4fd973b9d00c2423fbc13ea9799699b Package @k18k/[email protected] is a darwin-x64 platform-specific sub-package, following the standard npm pattern for distributing...

Malicious code in @greenlake/session (npm)

@greenlake/session is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 99.0.1, 1.0.0, 2.0.0 has a postinstall script that runs node beacon.cjs on...

Malicious code in @greenlake/mfe-login-url (npm)

@greenlake/mfe-login-url is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 2.0.0, 1.0.0, 3.0.0 has a postinstall script that runs node beacon.cjs on np...