MAL-2026-15853 Malicious code in @quantixfinance/supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f7218e15bdaaead1d170d28c2b67949c808b52985e36ec2f993573af1312f The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped substrings key, secre...

MAL-2026-15848 Malicious code in @quantixfinance/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains...

MAL-2026-15847 Malicious code in fieldbase-webapplication-buildtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c30b72acbc526ba924e071ebefd3bc3a131d6dc29abaa71fa76deab2836345e package.json declares preinstall and install lifecycle scripts that collect the installer's username whoami, hostname, current working directory, and...

MAL-2026-15877 Malicious code in btree-time-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a259c39e0c762f33b09b298c1fe8ae606adb43422478d06979461b816edf0985 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15873 Malicious code in btree-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180c50a02e5bbe5a57f622112bba7f7b01becd6cf85f6d9d4b8301699f4334b7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15891 Malicious code in ordered-kv-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55d622b138793a2b659f171c3420c5c66df969939d4e3be8c7d4099e4f4fd48f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15893 Malicious code in sliding-score-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e2a97d5dd3e10080ee69201bf757ea14ebda90b9da1be41392584152ad1f1d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15876 Malicious code in btree-range-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e7b5c5ccd56296e8ac25007af040c62f078c5953946fdae9fc1c67b0178f65f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15889 Malicious code in neighbor-key-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d780b9dd8236dfbb127579a5d58fac8423ea3992ce4900bf41abce906aae39 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15874 Malicious code in btree-leaderboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ceaaf14d642f02835e10e1eb7de05ea911ecf2b72bc354305aa3d6bf874e4e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15890 Malicious code in ordered-freq-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508695a38291fb41f6ca49b06070cf670e079fd43796e1812acabdd467ba9166 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15892 Malicious code in priority-slot-queue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28d9070a4736fe0ceeb43d3f01cad7456582c802e6bb0f84ab6b4e1050947316 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15875 Malicious code in btree-lru-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6842cca5e4f00ee191865c33d73bef23be7df2e06f8157394532bb26d9749a42 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15888 Malicious code in indexed-btree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcf3d23eb09d4a5d5736b43c78f6b140e79d23c0ac3488e84f3f1633c1ae578 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15878 Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

MAL-2026-15886 Malicious code in guci-wxrout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bb83d0fbcc9d1cd163b94168217fbe3cbe5a6bd365af14d47da094eeb7a1400 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15881 Malicious code in element-icon-guci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b47763652442a29a047d076f48a01b00f72f56af9bc28014f3cd4735f16e9f3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15880 Malicious code in element-guci-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43ee355ab038085d87ed11e81acc53a50163f14b617d54b7e9b9c31e800900a Package is published as an element-ui utility library element-guci-util, description '元素-ui 常用工具函数集合' but its main entrypoint contains no utility...

MAL-2026-15883 Malicious code in fullcalendar-windos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 942f89203237b7bb1f918d607864784dc6337b97df3fb598dda116c2b04e2370 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15885 Malicious code in guci-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8eec13cc0ba860ec3d0fced651c1d65f4122d358a8afc9a8b806d9d712d96af2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15882 Malicious code in element-utils-guci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86753bfc758ba4e9c2c759b41e85f2720f38585f5eb0bf42966dfdb7fab6ea59 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15884 Malicious code in guci-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c249413cd0bbe7f76321cbaeedac49d6ddbf63030ea67b514dd1a662e9fc8d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15842 Malicious code in google-internal-cloud-audit-security-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62a38a595d0fcf5e869dc2cdd939d476de1fbd24253eb6afd383c08c959dfc34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15833 Malicious code in apple-cktool-internal-api-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faeeff2b18d0a2f9f9a5d8d9543b6d950f49c64f6313b37fc02bc68aa9fd9d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15840 Malicious code in google-cloud-internal-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 655e243795a73e8b8b7f7b1c9b4f5769d1d13deba1dc53679fe6153b8405a531 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15834 Malicious code in apple-internal-test-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f166ea5f034867eae7d9bdc6f82b50c40a22b5237c6e591953d73947dd43244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15838 Malicious code in frank-apple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2074ea7bc8e4cebf5e583f23cb534632931139d702252dfc554b75bfb5866072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15837 Malicious code in frank-apple-sync-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eab07d55673f91c87c6cc53068aff313287a16eede0d4c388b71f2c71dd27e20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15839 Malicious code in google-cloud-internal-build-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1728b138f6952e0dc34092093671684665336dc895872005137581f1aa13fe93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15841 Malicious code in google-cloud-mono-repo-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6a8a52a13a2bca203b074422db3b908a9b961e1b849a86734a6a2a38f9504a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15827 Malicious code in company-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud...

MAL-2026-15828 Malicious code in env-validator-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964 The package ships no source module only egg-info metadata despite declaring a consolescript entrypoint 'env-validator=envvalidator.cli:main' that...

MAL-2026-15829 Malicious code in telemetry-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000 On import telemetryhelper, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname,...

MAL-2026-16010 Malicious code in AzureCdnInfo.edrtester (VSCode)

The Visual Studio Code Marketplace extension AzureCdnInfo.edrtester version 1.0.4 presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, extension.js loads edrdrill.js, which performs host reconnaissance — hostname, current working directory and local IP — and...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

MAL-2026-15825 Malicious code in real-router-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91fd520ae94997277ef7d591d30dc728b895611fd45b890e2ec1a68233e29a8 package.json declares a preinstall script that runs an inline node command reading the installer's OS hostname, username, and current working directo...

MAL-2026-15822 Malicious code in @stellarshift/chain-metadata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...

MAL-2026-15824 Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

MAL-2026-15821 Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

MAL-2026-15844 Malicious code in onceaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52acfee73c36f7df40ac54204cef235483203b7dec9208d5b219cb7068d341f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15843 Malicious code in is-generator-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93931fecef2da94abf1de73e282da2c510715512d61bfe8afd1197925f4b6e08 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15835 Malicious code in daisypick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9bd46c99a0d58d9ded0faca080e42efa9015c9bd213c46292e82644117d53ae The package presents itself as a Tailwind CSS color/service-worker helper, but the daisypick/plugin export reads a URL from...

MAL-2026-15846 Malicious code in tailwind-theme-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3a6ff1f2699ab0ea92a30416c4b043d70781bd4c7241c2fb497061a78866ab7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15836 Malicious code in eyiouss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bedee2fc7da5658522543d3fe376d8fbf1d3bc8386eb8f53df3ee080830b250 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15818 Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

MAL-2026-15817 Malicious code in peertube-plugin-poc-marker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff307f6227ac4a9217a899b419a6931ddfe0376cb0cc6ba3570c0f589247241c index.js runs id; uname -a; hostname; date -u; ls -d /var/www/peertube via execSync when PeerTube invokes the plugin's register hook, then POSTs the...

MAL-2026-15815 Malicious code in cminhouse-api-gateway-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42971bbb30a4cb0a1da27be3953339fdbda449e4d10e997aac72212df0a8b1d index.js is wired as the package's postinstall script and also runs on require via main. After skipping CI/test/Docker environments guards on...

MAL-2026-15812 Malicious code in eslint-rxjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2794273ee7e40da4b37c017636209acf1402b1104ab5fc265a43cc7d83228e72 eslint-rxjs is a masquerade package whose npm metadata is internally inconsistent: the name references ESLint/RxJS, the description reads 'Integrate...

MAL-2026-15814 Malicious code in chromatitle-dev (npm)

The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...