239737 matches found
MAL-2026-10926 Malicious code in defi-kit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc3facb1f07ed97dd9001874b4c4666b939bbff2ff4d8c5859d22e6013ed0c5d On import defikit, the module compat.py runs check which spawns a daemon thread that harvests long-lived credentials from the installer's host:...
MAL-2026-10925 Malicious code in tilaver-mfa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8713506d95648bc2ee9d15418c356259ca9f1d10fb305fd546e3d38c911aea0e index.js is a heavily obfuscated custom VM-bytecode dispatcher with 0x-style identifiers Windows infostealer that executes on module load. It...
MAL-2026-10920 Malicious code in alb-lambda-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...
MAL-2026-10921 Malicious code in iot-kfh-s3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...
MAL-2026-10923 Malicious code in lwc-slds-lbc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...
MAL-2026-10922 Malicious code in lambda-cloudwatch-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d62c2ab5388572a03d3c4f28ee268d562675a2ebbff48cf1375728f837365f4 The package's preinstall script npm install @sentry/node && node examples/verify.js executes on npm install and initializes Sentry with a hardcoded...
MAL-2026-10924 Malicious code in s3-lambda-dynamodb-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6517c8914c4ba64ce57809484229df7fbe5dd9f5129c40b19cec8a73c10a70ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10918 Malicious code in automatic-octo-invention (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2dfb4e3eedab24e355b6d24db6096e6752563e220d28e83ad2cf213fe49fd89 The package ships an 8.6 MB stripped ELF binary at automaticoctoinvention/claw sha256 f6fe45f8fe9081987505af31f0249021a65b558af514f2e4e37340fb3182805...
MAL-2026-10919 Malicious code in ml-core-airflow-auth (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a543a55b463967fa7f6b3c1462ecb38735072a4f4f47bf5f9b732e089a64b8a The package advertises itself as an 'auth token handler' but its public API src/mlcoreairflowauth/init.py exposes only a trivial in-memory TokenStore...
MAL-2026-10906 Malicious code in your-unique-package-name1337 (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10905 Malicious code in win-build-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bd3facc00c36861223058a572fbaa888d815a06c7b309c44639c544c65f1d9 The package name suggests a Windows build helper utility, but no concrete behavioral evidence is available to confirm or refute installer-side risk. ...
MAL-2026-10904 Malicious code in solana-web3-v1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0 Package name closely mirrors the widely-used @solana/web3.js Solana SDK while being published under an unrelated, unscoped name. The bundled...
MAL-2026-10901 Malicious code in solana-web3-lts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed Package name 'solana-web3-lts' resembles the widely-used '@solana/web3.js' Solana SDK, raising name-confusion concerns for installers reaching for th...
MAL-2026-10903 Malicious code in solana-web3-stable (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38824d7f6044fd3177aba408a5f815879762d8829e56cb6692e2cad652f7d9e6 Package name 'solana-web3-stable' closely resembles the widely-used @solana/web3.js library, raising typosquat concern. The bundled lib/index.cjs.js...
MAL-2026-10902 Malicious code in solana-web3-patched (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99e6f959c8df3e2933c860ba3d36dc5dbbd27d97a69a3e97a5a7feaf7e24899 Package name 'solana-web3-patched' resembles the legitimate '@solana/web3.js' library and is published as an unscoped lookalike at version 1.0.0. The...
MAL-2026-10900 Malicious code in solana-web3-fork (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 912cb41aa6b78cf62207dbf95f7d6247238483a800fa9bc6edd9b9d9f7819364 Package name appears to fork or imitate the well-known @solana/web3.js library. Bundled files lib/index.cjs.js and lib/index.esm.js contain...
MAL-2026-10899 Malicious code in solana-web3-fixed (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d36c0e75143828e4a93135d0c54fb34dd6e75588a493ade663a1fa4b231230c Package name 'solana-web3-fixed' resembles a fix-branded variant of the legitimate '@solana/web3.js' library, a pattern frequently used in...
MAL-2026-10898 Malicious code in solana-rpc-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57e3e79e60f9b8ec7f7c9b5199ecab2efaf72566eaed0f358a3b80adad5558d The package's bundled entry points lib/index.cjs.js and lib/index.esm.js co-locate require'childprocess', fetch/POST/GET calls, and references to...
MAL-2026-10897 Malicious code in golan125-homepage-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 705b0dc2e3b9aafb6d0e72ecb5ad51d873cd59104a045f74bb27161c87a24960 Package self-identifies as a security research test 'Security research test - do not install'. The package.json homepage field contains...
MAL-2026-10896 Malicious code in flow-eslint-oxidized (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10895 Malicious code in exodus-payments (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51394e5297d9dc765ee318eabd49e400b9f843c342ed91e3df9bd9befc84254e Package is self-identified as a dependency-confusion proof-of-concept. Its postinstall hook src/canary.js performs a DNS lookup and HTTPS GET to a...
MAL-2026-10894 Malicious code in exodus-checkout (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b10e41b9a87dc4927d3c4bc63b25bc1fa438cfae1bcf5f1d483204a18d5765f6 Package exodus-checkout self-identifies as a security-research dependency-confusion proof-of-concept targeting an internal Exodus payments SDK. It...
MAL-2026-10893 Malicious code in ecto-cargo-wk1tm59a (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee496f01ecebc77637213e597ba523c8cccda7efcd65e7ad2e700d804553dd29 Package [email protected] exhibits several contextual red flags worth human review: a randomized-suffix name pattern -wk1tm59a typical of...
MAL-2026-10892 Malicious code in claude-code-timer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04950731ec6589eebae22166fb042e4253719f71bfd3fc2b58f28d26ede9e43c [email protected] was scanned with no findings of concern. No install-time lifecycle scripts, no outbound network calls to attacker-controlled...
MAL-2026-10891 Malicious code in bytecraft (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b4433b369e2ff82bc33b11110ddfa63c15a2d685bf3484fb37092ae4bd077f No suspicious behavior was identified in this version of bytecraft. There is no evidence of install-time network activity, lifecycle scripts fetching...
MAL-2026-10890 Malicious code in analysis-chart (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10889 Malicious code in @public-for-cdao/utils (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10888 Malicious code in @public-for-cdao/signer (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10887 Malicious code in @public-for-cdao/sdk (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10886 Malicious code in @public-for-cdao/deploy (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10885 Malicious code in @public-for-cdao/core (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10884 Malicious code in @public-for-cdao/contracts (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10883 Malicious code in @public-for-cdao/bot (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10882 Malicious code in @public-for-cdao/backend (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10881 Malicious code in @irys-solutions/odesa-main (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 525ae6b33885c1153dac485b830c8977b433ba4cdd2cc9556415b146ed801569 No malicious behavior was identified in this package version. No lifecycle scripts performing remote fetches, no credential reads, no exfiltration...
MAL-2026-10880 Malicious code in @examplecorptest/hearsay-design-system-test (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10879 Malicious code in @dxcl/user-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10878 Malicious code in @dxcl/transaction-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10877 Malicious code in @dxcl/log-function-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10876 Malicious code in @dxcl/indicators-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10875 Malicious code in @dxcl/http-common-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10873 Malicious code in @dxcl/customer-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10874 Malicious code in @dxcl/fund-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10872 Malicious code in @dxcl/account-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10871 Malicious code in @azure-lab-services/ml-ts (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10870 Malicious code in @atlaskit-internal_.smart-card/hover-card (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10914 Malicious code in my_shoaib_gem (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10913 Malicious code in ike-artifactory-ruby (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10912 Malicious code in shark-e2e-bnsneo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d634ef25cc07c2f00565518ab2cd2484a0dbf70a5d32d81376f3f7592bd1804 On import, init.py decodes a base64-encoded string and passes it to exec inside a syncmoduledocs helper invoked at module top level. The decoded...