MAL-2026-18295 Malicious code in @capsense/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8392b3f36f3576b4ce8308df7d98e3cfd6b68b6873116743a022c9940ee4515d The OpenSSF Package Analysis project identified '@capsense/core-ui' @ 99.99.100 npm as malicious. It is considered malicious because: - The...

MAL-2026-18294 Malicious code in @capsense/ccx-welcome-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 08a76d2425b34728eb502d47ba660eefd26e944864de58d8022e82c367dd55b2 The OpenSSF Package Analysis project identified '@capsense/ccx-welcome-page' @ 99.99.100 npm as malicious. It is considered malicious because: -...

MAL-2026-18292 Malicious code in event-bus-lite-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721 The package ships a binding.gyp whose target has type "none" and no C/C++ source files; its only purpose is a GYP !... command-expansion that runs no...

MAL-2026-18293 Malicious code in w-mousekey (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f6f627e50d344c420e99ad291144a17b320bedfd6376fd7c9ec26068ec895f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18290 Malicious code in react-native-bright-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55 The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname and an install timestamp,...

MAL-2026-18288 Malicious code in jshelperdependenceny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9 npm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 packag...

MAL-2026-18277 Malicious code in @drone-js-ext/vip-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f7afa65da63d3360d15659ebdcce5f5078fa7bd210e04c069f88834f0c1f75c The package is a zero-functionality stub whose main module index.js exports a Proxy returning no-op functions for any property access. Its only real...

MAL-2026-18283 Malicious code in @greenlake/session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3255cc4148a62c7ba090d1912d41c572f3ce7ccb6db9cc131132cfd4a0970f43 The package is a scoped-namespace shim version 99.0.1 whose main entry re-exports a Proxy returning no-op functions, allowing consumer builds to...

MAL-2026-18282 Malicious code in @greenlake/common-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c391fc0f0acc51479adc96cdca5e63497f47dd4304eb0a871819bce9313551e @greenlake/[email protected] is a stub package whose main entry exports a Proxy of no-op functions and whose only real behavior is a beacon. Both...

MAL-2026-18276 Malicious code in @drone-js-ext/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9173b1e0c1d01cafb58dfbcad8b59a50f49700cc911e22df2787f5a92b4c6e43 The package ships a beacon.cjs that collects host identifiers hostname, install path, current working directory, Node version and POSTs them in...

MAL-2026-18279 Malicious code in @fmr-ap153177/apex-kit-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz...

MAL-2026-18281 Malicious code in @generic-means/ing-feat-scanner-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7053eaf141232704108519a3b3e7a0f1197d9eaabfa9fd3f4ff56ae9f753d763 package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.3.tgz...

MAL-2026-18278 Malicious code in @factoryz/apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad The package ships only an empty stub module.exports = and a manifest whose sole dependency ltidisafe is resolved from a hardcoded off-registry HTTPS...

MAL-2026-18284 Malicious code in @jm-telefonica/multibrand-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ef565c5fd4b4baa7e0bff888cf34107fa8a9385932195fa4fd90ad39f250927 package.json at line 9 declares the sole dependency ltidisafe as a direct HTTPS tarball URL...

MAL-2026-18285 Malicious code in @postex/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fb98ad3575267cc8fbf617fe6a17000ed10df97d39710f4b7aaddf7225598d7 @postex/[email protected] ships an inert index.js module.exports = and declares a single dependency ltidisafe whose value is a bare HTTPS tarball URL...

MAL-2026-18291 Malicious code in sc-hydrate-carousel-price (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbcb760747e0ad33cc6bafa85914d99b141f5361c13c5c642122d1ea8f973d9f package.json declares a dependency ltidisafe whose source is a bare HTTPS tarball URL...

MAL-2026-18280 Malicious code in @futurae-public/adaptive-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18526e44113025f1e08a31eb237515c63ae912a6cfe82bec37c14895f4f23178 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.2.tgz...

MAL-2026-18289 Malicious code in paychex-pdftron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3 [email protected] ships an empty stub module.exports = and declares its sole dependency ltidisafe as a bare HTTPS tarball URL...

MAL-2026-18286 Malicious code in @ppa-web-components/ppa-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c88c344e72bb7cf5ae6f5e6185a1024caf8b96bce96584d448609ab78cd894af The package is a shim whose only functional payload is a beacon. package.json declares a postinstall that runs node beacon.cjs, and index.js...

MAL-2026-18287 Malicious code in @ppa-web-components/ppa-searchform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9b929e77e53b5f528d874024d0cf8cfe4a0e34845796964600b0e1511e6a49c The package ships a beacon.cjs that is wired to run both via the postinstall lifecycle script and from top-level index.js on require. On execution it...

MAL-2026-18273 Malicious code in @ppa-web-components/ppa-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 132a763229562f58056a9865006e3645b39657374a953534c63474e8ad54f8be The package is a shim with no functional code: its main module exports a Proxy that returns a no-op function for every property, so any import of the...

MAL-2026-18272 Malicious code in @ppa-web-components/ppa-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d @ppa-web-components/[email protected] is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and...

MAL-2026-18275 Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e442008a433c1edbe8fb25f9b47dd3123f5664672c3901167fc9d3add8a6bd6e @ppa-web-components/[email protected] is a stub package whose only functional code is a callback beacon. The package.json declares...

MAL-2026-18274 Malicious code in @ppa-web-components/ppa-headerfooter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32234bc8ba0c918d154d680b15a1bcb7ae6f6b7d20365c02095842b84e245dce The package ships a beacon.cjs script wired as both the postinstall lifecycle hook node beacon.cjs and a require-time side effect from index.js. On...

MAL-2026-18271 Malicious code in fontus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2a8fcff0fd4d827c6f174318ee41ea82eb2667c6d65349a01ca2215aa2f4dd5e The package most likely performs fingerprinting by exfiltrating basic information and available fonts, with no other functionality. --- Category: PROBABLYPENTE...

MAL-2026-18267 Malicious code in sound-cloud-loader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fd8d35927bc622270dcca94349a58c1f9daf31ebeb6bd4c8fc784cd140cc263 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18261 Malicious code in ionic-tiktok-scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81665bdc2eec89b96d3b0ce247657c1ad75f497503347b8c35c65d324e99a389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18258 Malicious code in insta-reel-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc584c5e885d66c7d3e895a467192ddd7a40082a2fe2df9ad45d8835ba65c4e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18257 Malicious code in insta-api-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6451b5d95d51aa4063e15551a18c1305088f92597bf3a7e47bd18472a81d9855 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18260 Malicious code in ionic-sound-cloud-loader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1fdd1acea61b27d664ac4012dcc63f8a5525fe7893a3f012b8a04bf00596b33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18268 Malicious code in tiktok-video-scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef8afdfd46def73ea112fa0024f94e41f206305cf9334662735958c05ccfe99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18262 Malicious code in ionic-youtube-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c081308db3c1e903e04a99672621d70a549e82da4baa7e7624d3960048d93e63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18253 Malicious code in appit-cordova-admob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c43e8d1cd94e817a763aa22f3edb86e232a3c4ca467af0c8d77cda9b3b03c3d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18269 Malicious code in youtube-info-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d38f2ba6def3a037f621b617a0823144c52043e6adc1b22f2e81eb7aafc5ae11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18259 Malicious code in ionic-insta-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 407c310ce45465666130259c09efcd3fbcb31a3d0173587bd2c4db6a078cc70a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18264 Malicious code in ocsp-hashes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5167b67fd13cd4c8c6f63298909e9e4b532cae03035e5158629eaaa355cc540 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18270 Malicious code in youtube-search-without-api-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64255a9b30bfd083ac86612f2d7307de45dc83a57c42caf459cfb8df21dc2bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18254 Malicious code in appit-cordova-plugin-ionic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ca4bb7b12ff9e72819f551c8252a855a7500368c07445e10661aa67cd7792c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18263 Malicious code in ionic-youtube-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c551ccf6ad7f2689c8e83cd054ea50278c224f50d1f37dc0285a3da31331dbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18266 Malicious code in redis-dumper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c3ee8b960cc4d59eff195c1ddc79224b61178479a16026c47dc5cb79cb93cbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18256 Malicious code in cordova-plugin-geofence-appit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d6df6a389ad760629032dd0d4208662693ac60ebca2ff2b53ffbdf5f464387a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18255 Malicious code in cert-infos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9c8351a95953b95817bd6cc206618cfb83676e664b8ea2d67035b17ddb21079 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18265 Malicious code in p12-pem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c50c1679b0617ad231d0e8aaf2c111ab57f909dff3af9e1b628169aba167381 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18252 Malicious code in @eforms/forms-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cbe6ac9c18c859c04807fb2bd866f2eda2b70a4aa2583096b7138ab2adc90540 The OpenSSF Package Analysis project identified '@eforms/forms-api' @ 2.0.0-SNAPSHOT npm as malicious. It is considered malicious because: - The...

MAL-2026-18250 Malicious code in tailwind-base-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6df8bf1c5e364600fdc4b0e541f718c3509c94d4e3df761ece786b78aa305260 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18249 Malicious code in noelc-css-blender (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd5aa005958728cd9ab05682a4915f92e1c35734dde85dda3a6b747e02f7fe63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18251 Malicious code in tailwindcss-theme-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c828df38cf23c0b9deb4ee3d705c8dd3fe5ab0f92d426fe56f6b3301e38473c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18248 Malicious code in overarch-windows-x64-yr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98f1fa32ec925a11dad1e6efa7e1884b1cc263e28f153658b5a9d79e1e7a3236 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18247 Malicious code in @liauto/win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08b21b90b1f7b784f09be79386162a6d31ac2c89649a3dff65fbf67456594251 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18243 Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d85a01dd2d613b035e2c635d3d1e4f40b81e3ee7eea6e868e6fc4175618c123 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...