MAL-2026-16260 Malicious code in confx1789550882 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72ce9bca41cb0378952b582d6f115a3bffd2acea4999a90bae5f916428921b64 The package's main file index.js is an IIFE that, when loaded in a browser same-origin context e.g. via unpkg, reads location.href and document.cooki...

MAL-2026-16257 Malicious code in randompkgc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce22b64e51787a332ae7c65afc8789c0fb3f806199aa79d72af9ff02eb867d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16258 Malicious code in randompkgd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ebd1d508d7c8ae4aa2a0693b9d07720a837307b1a5c343c931c6e7d72d6390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16259 Malicious code in randompkge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95eb389e78a05b76dfefafd460f3280f3fabf8fcd1dfc55946b04bef84b26116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16256 Malicious code in randompkgb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80714d50d1dce2dbe400bba24113e27d669cc28dfc0d2b9194214a6322d3dc45 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16255 Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...

MAL-2026-16254 Malicious code in pulse-pwn-9f3a2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8086e23ce4b6ff1ca043ca8d9c83f384455e0baee3d06cd79e8a0d5d52c04e1 index.js contains top-level code that fetches /profile and sends document.cookie together with the response body to a hardcoded webhook.site URL...

MAL-2026-16252 Malicious code in ragacateslikodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09a5a8774b4ce673a050b7e26c7d08aec66320fc14257196157363935ac19aa1 On require/import of the package's main entry, a top-level async IIFE probes http://localhost:5000 for a hardcoded set of paths /admin, /flag, /profi...

MAL-2026-16251 Malicious code in tailwindcss-contact-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b198bc6d5af472f9cb1f1db25acf0215b77c04a742fcce81fef5565d76d837b Package presents itself as the Tailwind CSS forms plugin README is a verbatim copy of @tailwindcss/forms and its package.json points at...

MAL-2026-16250 Malicious code in marketing-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87216e00fe68e2de8b140f1f9ffc2db5a8e814f38030e2eb6120c9ae9e7ca3ff The package exposes an MCP tool sendpath that reads a caller-specified local file and POSTs its contents to a hardcoded...

MAL-2026-16249 Malicious code in kartykgithub-takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6844bb41cfa32b3ead1bd2558d13f9114c93fc9cea7be43ed4063726f259d405 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16248 Malicious code in kartykgithub-takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be4b64316a832dd3482cc41c21d79e2005d5984e2458ed45e957ee761862de31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16253 Malicious code in laycot (npm)

This package is part of a malicious npm campaign published by the laycot account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

MAL-2026-16247 Malicious code in pkg-rollback-dreed-viced-sonic-ponds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5c66c5e78670d2099776492aa1a836a031eea3a9d43b2ffe5911a19b62c71d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16245 Malicious code in kartyk-github-single-ver-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc583cefb03bc649c96d2e8b48cc2bd5d73d8f6c489ded9b46c217ba1f212ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16246 Malicious code in kartyk-github-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cf7fd25b60cd680892113ab7de697ebe897542c013c8c4a977bb4852a593619 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16244 Malicious code in kartyk-github-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0bc4570b5c41bc6a589bf16daea1a90f52e57b878fe6219afb1102ec24c535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16242 Malicious code in trongappy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145727605bb141edc0fa9697253b211a1b0e467db2a484a2cedd163bcc6df1b7 The package exposes a single public function permprivatekey that POSTs its privatekey argument as JSON to the hardcoded URL...

MAL-2026-16241 Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 486630eaee2b9eb50d03d73886a14b7249b0c28fda2cb3f6a13565c8cd38a9bb pypi package rak-lab-yoav-orca-zrktd2cp5hjmo4x7 version 9.9.9 ships a setup.py that, during pip install, reads the DEPLOYMENTTOKEN environment variab...

MAL-2026-16240 Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

MAL-2026-16243 Malicious code in idx_form_script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3 [email protected] is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal...

MAL-2026-16222 Malicious code in @traktis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...

MAL-2026-16223 Malicious code in @traktis/environment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9bdabc95f4e8bc70e348557c1cae7d2447d9bd1405ac7a23945ded47ec04a8 package.json declares preinstall and postinstall lifecycle scripts that invoke curl against the hardcoded cleartext endpoint...

MAL-2026-16234 Malicious code in strapi-plugin-os-rec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b7f08345375bd52a25c34cc61a3e877c1a9f8f364a90a76b3a1eff55216ea03 postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.platform, os.arch, os.type, os.release, the...

MAL-2026-16228 Malicious code in strapi-plugin-ccrev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbcdfb404042de180795640d5ea266d8fe50afff5d180b3da0eab17f979369f3 postinstall.js executes automatically on npm install and opens a bash reverse shell via /dev/tcp redirection to the hardcoded remote endpoint...

MAL-2026-16235 Malicious code in strapi-plugin-osag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34d9349a970008e54774fc533af589248d578e1d34f6f82a9a6630beeabd2203 The package presents itself as a Strapi plugin but ships no plugin code — only a postinstall.js script that runs automatically on npm install. The...

MAL-2026-16227 Malicious code in strapi-plugin-ccrec-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27dd1178f43debcd9babc6630aa303b6953e7572d994f8efe3acc75db2cc878e The package's postinstall lifecycle script postinstall.js executes a bash /dev/tcp reverse shell to the hardcoded remote endpoint 14.225.210.85:80,...

MAL-2026-16225 Malicious code in strapi-plugin-cccon-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c0ca5cf1881ed03c4a8b91832bcd8f65854bd36d9b764843370d26f599c2a0 postinstall.js runs automatically on npm install and executes a bash reverse shell to the hardcoded remote host 14.225.210.85:80 via /dev/tcp, granti...

MAL-2026-16237 Malicious code in strapi-plugin-persh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ce68eeb9a309b5fff512e24a1b8f4c12fb171c0752d6a04293a4e72c805088 [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script spawns a...

MAL-2026-16239 Malicious code in strapi-plugin-pysh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 188e8ecd93a0124135c178af848914dbd0f8cc7c3f9fdc7f5137fc94e46bb27d [email protected] ships a postinstall.js also declared as the package main that runs automatically on npm install. The script uses...

MAL-2026-16236 Malicious code in strapi-plugin-perev-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29840a9eddc4894177d910b38ef1808c0ba7a402c267160fe8e86cff48873700 The npm postinstall hook executes postinstall.js, which uses childprocess to spawn a Python reverse shell that connects to the hardcoded remote host...

MAL-2026-16226 Malicious code in strapi-plugin-ccip-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf7a24da69c80ba7475efcb12c97f1be8b4ebbed42b47131ac9716ff38d5620 [email protected] declares scripts.postinstall = 'node postinstall.js', so postinstall.js runs automatically on npm install. The script...

MAL-2026-16231 Malicious code in strapi-plugin-honey-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 752c0a1146068824e355a38b25add15f092d7cea6f846c143b5b2d2210de6766 The package's postinstall lifecycle script postinstall.js spawns a Python-based reverse shell that opens a TCP socket to the hardcoded IP...

MAL-2026-16229 Malicious code in strapi-plugin-conresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d117fca143f7c8f02261755b923b29cae47f8fdcca2f69f169e26a5601b3661a The package declares a postinstall lifecycle hook "postinstall": "node postinstall.js" that executes on every npm install. postinstall.js invokes...

MAL-2026-16230 Malicious code in strapi-plugin-feedmeeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ecf1e41fb24d24ffe7b55319dda947ae30bfabb9266e38c17e1231cf4492ec5 [email protected] ships a package.json postinstall hook that executes postinstall.js on npm install. The script constructs a bash reverse...

MAL-2026-16238 Malicious code in strapi-plugin-portcc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f04ef6b35ce447e6825a520a88eda4fe27ebfe6214648906db673e7d57ea86b Package advertises itself as a Strapi plugin but ships no plugin functionality; the entire payload is postinstall.js, which is also declared as the...

MAL-2026-16233 Malicious code in strapi-plugin-maylog-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d714c1585f058d5ac528832398ffe2d0035fd8b60e97e461cdfa8e1533e851c The package's postinstall.js lifecycle script executes automatically on npm install and spawns a python3 reverse shell that connects to the hardcoded...

MAL-2026-16232 Malicious code in strapi-plugin-listcc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63bef6a3804e282781fb0eaea1ffd045ef3b236aefd0668de11549aba1ada8b0 [email protected] declares scripts.postinstall = 'node postinstall.js' and points main at the same file, so npm install auto-executes...

MAL-2026-16224 Malicious code in process-mite (npm)

This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

MAL-2026-16219 Malicious code in licloud (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 380753d9b58e068e84b5bd87242ad31e4b833cdcc056021925aa2dcc91633b46 setup.py unconditionally collects the installer's OS name, username, and hostname and POSTs them to a hardcoded plain-HTTP bare-IP endpoint...

MAL-2026-16214 Malicious code in discord-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...

MAL-2026-16213 Malicious code in discord-players (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eadb25768efba4ff9dc9170a838f90f6572993195d37e526543fa956e65faa2 index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd excluding...

MAL-2026-16216 Malicious code in tetomood (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c09686feb7c38e815ef9a615a6ceba2444029a34ea9d6bee8598a76bc8e8f92 package.json declares both preinstall and postinstall scripts that invoke wget to POST the installer's current working directory $pwd and machine...

MAL-2026-16217 Malicious code in tetotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6 package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory $pwd and...

MAL-2026-16215 Malicious code in engin1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e843727c643c5d966acaa66461f7e392813a4284cd8181b4bb9b24ddfb8447a The package's main entrypoint index.js invokes an initializer at top level that spawns loader.js as a detached background Node process on every...

MAL-2026-16207 Malicious code in chai-as-agile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263 On require'chai-as-agile', index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to...

MAL-2026-16210 Malicious code in strapi-plugin-pencc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208 postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname to the hardcoded stri...

MAL-2026-16209 Malicious code in strapi-plugin-ccsuc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fb6207f1b4ec4d94c724583a5f32b85f68d203e1a9e6372705b410efbf9173a The package's postinstall lifecycle script postinstall.js, wired via scripts.postinstall in package.json checks the installer's hostname against a...

MAL-2026-16208 Malicious code in otel-span-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e800a0d88fb9a757c0ca5ecc09f0217522e72575d3e570a87c167090740de7d The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads...

MAL-2026-16211 Malicious code in swnwall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fb3b7b76f32b1c101b04c15933b403658f199267e9c3c34ebea9aba917949a On require/import, index.js invokes initialize which spawns loader.js as a detached, hidden background child process detached: true, windowsHide: tru...