MAL-2026-18208 Malicious code in @ecg-internal/favourites-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0f37fd70766d2ddda31ffe3b985eba596fd927fdd589a9ceff04d4a695e3bb1 The package publishes under the internal-looking scope @ecg-internal/ and ships a postinstall script beacon.cjs plus a top-level require side effect ...

MAL-2026-18206 Malicious code in @ecg-internal/adobe-dmp-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a24a1672f5d2075c0159dee85aaad5dcb27d0cdc7eb6e007bfdbb742b82149f Package uses the @ecg-internal/ scope resembling an internal namespace and ships a minimal stub whose only effect is to beacon host identifiers to a...

MAL-2026-18211 Malicious code in @ecg-internal/reviews-dialog-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d077157e19fb33158004d020ab55ba68751851a9dbab6a010064a83b8436c4 The npm package @ecg-internal/[email protected] is a dependency-confusion payload targeting an internal @ecg-internal/ scope. package.json...

MAL-2026-18205 Malicious code in @tekmidian/pai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26877c40609e311219c5193d5c1e2c50b5edf63913c0e4d7ad2be298e11f631 The package ships a bundled Node CLI under dist/ composed of multiple minified.mjs chunks cli, cli2, hooks/worker-, routing, project-setup,...

MAL-2026-18204 Malicious code in @factiii/runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4c4794df8d9ce74d46f674a9e583b9a296e9fea534e654a5b5dfd46c1a342a @factiii/runner is a remote-development bridge that pairs the installer's machine with Factiii's mobile/web clients over WebRTC through...

MAL-2026-18203 Malicious code in journey-teste-shellhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-18200 Malicious code in @seggy116/next-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdaf2231c55ef54e12dae1b21d66b26c516db292f26c753dcc49a62745eca4ea The package ships a bundled UI asset at dist/ui/app.js in which the token 'ping' appears multiple times on a single minified line. No code path reads...

MAL-2026-18199 Malicious code in @pkgship/frps-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f2c1a511013dd65df6260ab26fef946005adb17532ab20070c95e1d5157608c Package appears to distribute a platform-specific binary frps linux-amd64 under a scoped npm name. Only two files were present in scope and no...

MAL-2026-18198 Malicious code in @pkgship/frpc-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 342b27b61267fcea7e459b9079bf0ab2eca982a2421c4d497685126ac6931d31 Package @pkgship/[email protected] is a platform-specific npm distribution for an frpc binary targeting linux-amd64. No install, preinstall,...

MAL-2026-18202 Malicious code in sdk-utils-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7619a01266c5e5b533601f9124beb17a426a17b5bc6f7c584e98c7d94a60defa Package [email protected] contains two files. No install-time lifecycle execution, no outbound network activity, no reads of installer secre...

MAL-2026-18201 Malicious code in kvarzo8f3atestmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a85ccef88aba99ac71165f2b02e40f009e9ac8d25319da2abe5a712a1886ac47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18194 Malicious code in @lumen-labs-dev/whisper-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9643145fda005627c853ce885fce2cba3f7c4ad008b8e3925fc2639b270567b The package was scanned and no a static rule matches or traced behaviors indicating supply-chain attack patterns were observed. No lifecycle scripts...

MAL-2026-18195 Malicious code in darknode-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf377da86ddd8f8aecddff593aa975c5dc86103d80434027cd2019e9dfa1cde Package is a command-line offensive-security / pentest toolkit. The flagged files lib/nexus/pentest-engine.js, lib/toolkit/network.js,...

MAL-2026-18197 Malicious code in x402-prompt-injection-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846c141b5529a8d720ae77d89b02267e64a11013a2d278d08f899dbfa31f2dce Package [email protected] npm was scanned with no a static rule matches and no traced behavioral findings. No install-time lifecycle...

MAL-2026-18196 Malicious code in imgdecode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d35e9f4292a2c57b47ea07b9202c69623374c4c6afaa588ff849d213ffbbef2 [email protected] presents itself as a native image buffer decoder but ships a 224-byte index.js whose only runtime effect on require is to load the...

MAL-2026-18190 Malicious code in @liauto/darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7908d3c29504b802e6f8e6b53e9fdc9062f8f4c1129ba6cf2966908729faee95 @liauto/darwin-x64 is a platform-specific darwin-x64 distribution package, typical of the optionalDependencies pattern used to ship prebuilt native...

MAL-2026-18191 Malicious code in @pkgship/frpc-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86e33dd3c91ccce255b85fe38d92b75fa31dc4959cc6f443984603add37971c4 Package ships a platform-specific darwin-amd64 build of frpc, a reverse-proxy client, as a prebuilt binary artifact. No install-time scripts, network...

MAL-2026-18193 Malicious code in opencode-skills-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad4663af5b87079e1a7cdbfd6f3626801e542f7fdfe79316dec31974dd625941 Package bundles a collection of skill directories containing various helper scripts. Static pattern matches fired on routine network primitives: a...

MAL-2026-18192 Malicious code in agentic-awesome-skills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce718f3dabec30c962c7aecf6eb41f2583d7158f48af6dca9ec8adac61f6297 Package ships a large collection of 'skills' subdirectories 8234 files scanned, each containing its own helper scripts. Static patterns matched on...

MAL-2026-18188 Malicious code in 1h1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 04938e0ebf8781fb6c986fda09db9f4a60c240eb6dc79ab33e6faf7a5589b353 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-18189 Malicious code in aanthropic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 47e89f1629f5ff807eed865fd160d61ba0bb37d1a50f82922f4acd48c52d99e0 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-18186 Malicious code in net-codec-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf1dbafca56ccfcb849f9ebb80b7a1cdf42007fd12618492620e0f7660476b2 The package has no native source files but ships a binding.gyp whose sole target is type:'none' and whose sources array uses GYP command expansion !e...

MAL-2026-18185 Malicious code in log-rotate-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's...

MAL-2026-18184 Malicious code in formatting-subtitles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed...

MAL-2026-18183 Malicious code in @conduitops/logview-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28d0b0e9770a9db54aa03ba508bea0ed1b7ff5fc76ab28a472f09e7a8af088c7 On install, package.json's postinstall runs node install.js, which reads lib/toolchain.json and executes npm install @conduit/[email protected]...

MAL-2026-18187 Malicious code in simplewave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d984cf27dec602e96199a4361b485f0a7c79e2134977a355d42ddb46edd606d0 [email protected] declares a postinstall script in package.json that runs an inline Node command performing an HTTP GET to a subdomain of oast.fun wit...

MAL-2026-18155 Malicious code in acoustichub (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a31d5b9e7319cd715f9cfcd79aecbc918ab308c3e52a9abf132b026f059ee62f Analysis of acoustichub 0.1.0 did not surface install-time execution hooks, outbound network behavior, credential or environment reads, or other...

MAL-2026-18164 Malicious code in phonemeprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 512df61ab08fac605506c163f82f1376ea75cdac4b9725cd4a5c3509c09e324e No credential access, outbound network, install-time code execution, lifecycle-hook activity, or other installer-affecting behavior was identified in...

MAL-2026-18170 Malicious code in ttsflow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a62148ab04b3109e06da6f1dddfd10481746b4b18218e51f6f99852cea7a1744 Analysis of ttsflow 0.1.0 on PyPI did not surface any behavior indicating a supply-chain attack against installers. No install-time or import-time...

MAL-2026-18161 Malicious code in evalstream (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ca7b14989e601c74369996f80d2c6b6bd68200997d3a0368ba00652ade2799 Package evalstream 0.1.0 on PyPI was examined and no install-time or import-time behavior indicative of a supply-chain attack was observed. There is ...

MAL-2026-18166 Malicious code in speakbench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be2f131c6ccc3795c4cee48c62afe35c2b1290d788d2f59a83abc887ebde897 Analysis of speakbench 0.1.0 across 10 files produced no indicators of installer-side harm. No install-time or import-time network activity, no...

MAL-2026-18158 Malicious code in audiokit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc332d3293b7d462881b4b1ea1c58fd9ae9d603f42ca0a06bb6b3bc8f33b67bd The package audiokit version 0.1.0 was scanned and no install-time network activity, credential access, dropper behavior, silent-relay mechanism,...

MAL-2026-18163 Malicious code in phonemeforge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642b1da8f4deb8f186e5a24a7df2363db4a2a39f749bb59881a9621df7e62926 The package was scanned and no indicators of installer-facing harm were found: no install-time or import-time network activity, no credential or...

MAL-2026-18173 Malicious code in vocabbench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e1091de0d2cae2b06d37e8bb178f125540f3cbd35aab2666e0ace031f04cb47 No install-time, import-time, or runtime behavior indicative of credential theft, remote code execution, silent relay, backdoor, or dropper activity...

MAL-2026-18157 Malicious code in asrloom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd20eda3837d1f9497fcbd0cdf6826a2bff936766bac7e8d0a3f8b11ecaf15d3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18160 Malicious code in benchworks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 606e74602d9241e80622f42ed81f9040fe733889abd2003a862704c1d2d72595 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18159 Malicious code in benchbridge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e329737ae059eda6e9d4d0e57c74c937cc38746b707cc5dbbceac5387fb6926 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18168 Malicious code in speechprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efdeb2bf7d6e8d4071d0f6d39bbad679cbca3549d0298b6503dc3974fec20a9 The package contains no identified install-time, import-time, or runtime behavior that would compromise an installer. No lifecycle hooks performing...

MAL-2026-18165 Malicious code in soundsocket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17292086eb906d22ce89e72fb3d6f1bd9edf44d8bb7a7caa319cee80ee6381bb No install-time or import-time behavior consistent with credential access, outbound exfiltration, remote code fetch/execution, persistence, or...

MAL-2026-18162 Malicious code in modelworks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7152b8dcf58e19c79d1f0622dab8f60fd17a1f21fc94d06d28fa6103c840d9fe Analysis of modelworks 0.1.0 on PyPI across 10 files produced no evidence of installer-harm behavior: no install-time or import-time network activity...

MAL-2026-18174 Malicious code in vocabblend (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f512985b20dc469ed3bd4e8e382b358fdbffa1153f5fcadb3d6dfeeaeeac84a0 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18175 Malicious code in voicekit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 963d403cf4d9c68ae8a3047dba639793fc4669e0953662c923c9a1eacb5f5402 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18172 Malicious code in ttsweaver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cf25be0936bf389bd4c150fdda0e6801d5916e7d3c386695ece9360dbb39c085 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18171 Malicious code in ttsprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3ac396ae8349e2b92e5405345d32a2be4358267a33a1e26b1dd9d062e420443 ttsprobe 0.1.0 PyPI was inspected across 10 files. No install-time or import-time outbound network activity, credential or environment scraping,...

MAL-2026-18169 Malicious code in ttsdock (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd67309a16135e30efc3aad2f8d234cc48fed3ffdaa4d32b6345cc368963e775 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18176 Malicious code in voxweaver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 864111ebda91af60c9791e2352b3d95b32e6b6da08e9bcb0a674a6a23ab3ffdd Analysis of voxweaver 0.1.0 on PyPI surfaced no indicators of installer-side harm. No install-time or import-time network activity, no credential or...

MAL-2026-18167 Malicious code in speaksocket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d8c791801cb052f99ffe3ca30fd6dcacb5a3c4c42f6487e94bea779dc9f01b1 No install-time, import-time, or runtime behavior consistent with credential theft, remote code execution, silent-relay, backdoor, or dependency-chai...

MAL-2026-18156 Malicious code in asrdock (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df355a2f1d1cc0d420f953cf7f89aefb0ff9a6ae0c366552fbb8e94e319b151a Analysis of asrdock 0.1.0 on PyPI produced no indicators of installer-side harm. No install-time or import-time network activity, no credential or...

MAL-2026-18154 Malicious code in pipegrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c963e2aeb6a7a16e64f855c57cd12673b8719223ceec141eabf4bd0df606e51c pipegrip 0.1.0 ships a small Python package with no observed install-time or import-time network activity, no credential or filesystem secret reads, ...

MAL-2026-18153 Malicious code in hookgantry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc8005889d1341b2a59a879ac055990fc071ea11c67093f04f88ebf15caeb90e The package hookgantry 0.1.0 was scanned and no indicators of installer-side harm were found. There is no evidence of install-time or import-time...