MAL-2026-14511 Malicious code in svelte-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3c51575af766a500130198af6b3b93efbc81f522edb9e0deec2a9da0a421db The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14509 Malicious code in r4wk-book (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f5cbca68751eb879140f7c896a0dc3c324e9f4dbc8a1651b38b246b299ba4eb On npm install, the package's postinstall hook runs node.worker.js, which detaches a background child, waits a jittered delay, and opens a TCP socket...

MAL-2026-14513 Malicious code in typedoc-xyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0351fe37644a8a60b6072329167e3b1cbbc8ebac67ec75b453a475e90ac67a15 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14512 Malicious code in tailwind-scrollbar-hider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaa2dba899c9723740dfcc2fe8588bcf695f021442bbe8de1156239029bf7987 dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes evalatob'' at module top level, so the payload runs on any...

MAL-2026-14505 Malicious code in voice-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4e872ad9052cdd5d86c4c1656c57e5a899513853824efc24d4636a3c1679e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14504 Malicious code in video-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdb2c9b6369a68d75f6e0df274da90f2685d5735f944992516f13c3e9f60b0b9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14503 Malicious code in text-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163de9a9fb651da86f266476767aea6f3b53b316ad3a3b269d469e6447fe43bd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14500 Malicious code in svelte-streak-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b054f1d8e8f496e3bdabacf1bf5042b2aba5f9587646cbb874ae9e3ec9c7c7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14499 Malicious code in svelte-map-metric (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2880778c6f9a95fb00d5476c859051c8d9645b321b6d84613a3c28fd55ed0bef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14495 Malicious code in svelte-hydration-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f997a8db8add85fb519c98d2171e0a540bd9d4949a9dd0e0445ed98cd59db9ab The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14498 Malicious code in svelte-intake-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 828a6fbcf086b6736c00f10ab9346c3bbd3904ed3505852e2b4d342a379cdd79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14494 Malicious code in svelte-goal-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 599aa19770a72a0fa6e983e317d13b3647eaf8412d4b5b7ff10067be4ed34c82 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14501 Malicious code in svelte-streak-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11ecbb895ab58bd860a0104e8ce0cea32f5d34ff53f118ae8591387f5d6121e5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14502 Malicious code in svelte-streak-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 211b40d9426fc23200004fb66f846a5e31dd27dafb924bd99957954f6f4dd1f6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14497 Malicious code in svelte-insights-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13837ce89a955f11d9e25b59ca9b59b96ffef7d05338f95b42d1fcd062c7b543 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14496 Malicious code in svelte-insight-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b58dbba652e648d3f172a1b9ceffe28679dbae47aaeb8b29eed4ac964556f48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14493 Malicious code in svelte-daily-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47e6392583e46c5137935ed3fb8e29feab51a88b0ddafaf033a27962f8588130 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14492 Malicious code in spotify-url-infos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72208a0a63e3b9eb2549151c6b0899d84e79df1a1058cd72e048c3a44592440 Package is published under a name resembling the legitimate 'spotify-url-info' but its shipped code is an exfiltration tool. index.js invokes...

MAL-2026-14491 Malicious code in chai-as-otc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf771adc4f92ba0d79ea56bdcc1e42db57d1bc7421f0dadb0544f619e16b5ca1 On module load, lib/initializeCaller.js required from index.js runs an IIFE that POSTs the full process.env to a base64-obfuscated endpoint decoding ...

MAL-2026-14490 Malicious code in mkb-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27bc086d2159cad3d4eb02427ea2daa5f66ad57c39cbbaad5a8bb367071f4fb7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14489 Malicious code in hydration-cls-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c60e3a0dd707077bad78ec7f0e5f79032dc9b86814d65bfd0083275a6059de The package advertises itself as a dependency-free streak/date-math library but ships an x8664 Linux ELF at dist/internal/calc.dat and auto-launches...

MAL-2026-14483 Malicious code in modules-newline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c5565e7fd7984da26242b79340fb41f4f4595fdd5fbeb929ff5dfca5b13cc1a package.json declares the package's own name, modules-newline, as both a dependency and devDependency pointing to...

MAL-2026-14484 Malicious code in react-remove-properties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba88629ecae2a180282c29fd385e0bb2067193f01bb3b482b550ae50765d246f package.json declares the package's own name in both dependencies and devDependencies pointing at http://pack.nppacks.com/npm/react-remove-properties...

MAL-2026-14488 Malicious code in python-walletlibr-v (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello that prints 'Hello from my custom...

MAL-2026-14486 Malicious code in spf-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77 index.js is a heavily obfuscated browser script obfuscator.io-style string-array + rotation advertised for inclusion via unpkg on Shopify-style...

MAL-2026-14485 Malicious code in secretkey-2fa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeed1d38c9d76ae5e5f6657f1935bfd276c102c5d245b0992f6b57e5855a24cd Package presents itself as a zero-dependency TOTP library but its postinstall hook node lib/core.js and its advertised validateSecret API both trigge...

MAL-2026-14487 Malicious code in spotify-url-resolovela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93f6315c9b94537e8f2ba85260ccc147a6fdf9ab19336609d10e9819db575045 On require/import of the package's main index.js, a top-level startBackupLoop call runs immediately and reschedules every 60 minutes. It archives the...

MAL-2026-14482 Malicious code in vite-plugin-images-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ac1f55db3f6447b28ded9ee9c6b792487d225e52fe5ec393f75887001a5388 This Vite plugin, advertised as an image-analysis tool, uses transformIndexHtml to inject an inline script into every built HTML page produced by the...

MAL-2026-14481 Malicious code in vite-plugin-image-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019affd7dfc88e28b20dcce52fe53661a514582fb11c51871126b967399a01d8 The package presents itself as a Vite image-tracking plugin. At build time its transformIndexHtml hook injects a script into every produced HTML page...

MAL-2026-14479 Malicious code in vite-plugin-bug-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127a50da55320d2b9e8e99e06d4cccf3d005cc997f3845bcae0738339cd5b882 The package presents itself as a Vite bug-tracker plugin. Its transformIndexHtml hook injects an inline script into every built HTML page produced by...

MAL-2026-14480 Malicious code in vite-plugin-image-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61313bbeab91eb687fc7969f9dcc1478d4b672e1f02f91e56fa886e5ea7bd04 The package presents itself as a Vite 'image analysis' plugin but contains no image-analysis code. Its transformIndexHtml hook injects an inline into...

MAL-2026-14478 Malicious code in mham-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0dc3c71ee333b190e3e7202f7a222b4fe242fd50974cda9ec122b4200bd5f4f On import of mham-js, src/api/session-api.js runs top-level code that reads a file outside the package tree at../../../../public/logo.ico, decrypts i...

MAL-2026-14477 Malicious code in js-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5bb2e2d2011a8e8bcc3c0fba8aeed7cca1e1b92e19ea867535a27dbf2cc500 On module load, src/api/session-api.js reads../../../../public/logo.ico a path outside the package, DES-decrypts the contents with the hardcoded key...

MAL-2026-14475 Malicious code in ecobee-home (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a02620d2c1be5db8251957a24b2dacf01b146b1ee009169a9d828cb1f2a7425 The package's declared postinstall script runs beacon.js, which issues an HTTP GET to a hardcoded bare-IP endpoint http://169.58.96.170:9001/cb...

MAL-2026-14476 Malicious code in ecobee2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42ebdeda4d4d0b3db14833d23a2d75a55e7e3f6af902f0ba6f545a970c0f09ba package.json declares scripts.postinstall = 'node beacon.js', which runs automatically on npm install. beacon.js performs an HTTP GET to...

MAL-2026-14474 Malicious code in ecobee-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebaf39f3f17cfdfbddac8bb4f92aaa1fd600b7f0a69def35d879ebe5d90f14f On npm install, ecobee-api runs node beacon.js via its postinstall lifecycle script. The beacon issues an HTTP GET to the hardcoded bare-IP endpoint...

MAL-2026-14473 Malicious code in css-import-order (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a190c01197be10bae5104dd08b8cb119ff1460eaa0c816bc0eb74da8a4b88ae4 package.json declares the package's own name css-import-order as both a dependency and devDependency pointing at...

MAL-2026-14472 Malicious code in cscasereadserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 336250fe38295375704495b6529ed6eb82f7006b6249c78ace08bc92d96d4bde [email protected] executes a preinstall script that auto-runs on npm install. The script collects the installer's OS username, hostname, an...

MAL-2026-14471 Malicious code in cat-embed-i18n-res (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c612800e80bb36720e75741be9665ab6acbed58bcd5d51065fcedd1d990aaad0 The package's only shipped content, strings.json, is presented as an i18n/translation resource bundle but its values are HTML/JavaScript XSS payloads...

MAL-2026-14456 Malicious code in desmosmathwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccdafeec1f447c84fcca9f7f17e41c8e940b8bd65c9caf72b1bddbb2befdea4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14453 Malicious code in desmoshomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fae975f53feac57fc6aec90279e55e994d6e61d177217b012dfb59c6f42a7e8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14448 Malicious code in classroomhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b64edbbd8d1e23d937c4697de257a67981be2ebb2934a4280424a86f4af7028f The package's index.html impersonates Google Classroom title, gstatic favicon, hardcoded student email [email protected], decoy schedule/gradebook...

MAL-2026-14454 Malicious code in desmosisfire (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0679b40ac71c7b8ce0dc0557c8779a85ad10fac03ff678128ec4aa687c5e243 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14451 Malicious code in classwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf8dab0502db54359ed8c53423750080abd441eae407040f20f205f5b0e10255 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14447 Malicious code in classlesson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5980732c2d869f27728cb78552b2adf259f87f10029674e2e84a4db390377c67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14458 Malicious code in desmoswork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92541d82d133f0d80ad0e7dd4dc1595038f64af50558f26398c0a1c3627928aa The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14463 Malicious code in schoolhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 207beec4a342cd3a46c5a21ea6b76c3e84e88374f40a76b6c5761859a76ea2c4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14465 Malicious code in schoolwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fab9688948b5e3cab55bea7282280a554f1e60f85b947724b5f9262cd6a1823 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14468 Malicious code in tungtunggod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cfc083fc4a77544ba957b1c1d771998929fc71453f905f6d9c474e2bd3fb51f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14470 Malicious code in whatsgoodlookingbabycreed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e598067256b5fe5407b1f8b201925a118b6a08ea19be59cc80db3c60082fe19b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...