MAL-2026-14135 Malicious code in @mohamed_nowisar/token3-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d463b1de43a90878da858dd595dadf43fcbbbb9d2e26cfd8b14ff6e0167457 The package registers preinstall, install, and postinstall lifecycle hooks that all execute beacon.js. On any npm install, beacon.js collects the...

MAL-2026-14134 Malicious code in @mohamed_nowisar/depconf-canary-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078a8dc3351eb44ee9ff0d5992b9082b726d7fbce0152ae2d44595a9e279ef82 On npm install, the package's preinstall hook runs node beacon.js, which collects host identity os.hostname, os.userInfo.username, process.cwd,...

MAL-2026-14136 Malicious code in agora402-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...

MAL-2026-14137 Malicious code in mtslink-depconf-probe-profileusername (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f679922753b7a59c59af851ae74275b5d4760b13fc516bc8c68e8e9568393dc6 Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.c...

MAL-2026-14138 Malicious code in optimizely-starter-kit-for-fastly-compute (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72b7bcd65cbf07a90130de5e4a29fb72bc99badb287a1e1dc7373c288a1ae0be package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects host identifiers...

MAL-2026-14139 Malicious code in prism-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6570c9056bf020fdada0366045c4e91a0f5cb21171fe27df9fcea82259e7809 The package declares preinstall: "node index.js", which fires automatically on npm install. index.js collects host identifiers os.hostname,...

MAL-2026-14158 Malicious code in deepface-weight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...

MAL-2026-14140 Malicious code in vite-svg-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f The package's exported getPlugin/setPlugin functions decode two base64 constants svgValidateKey, svgValidatePattern at runtime. svgValidateKey decode...

MAL-2026-14133 Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

MAL-2026-14132 Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

MAL-2026-14131 Malicious code in infogram-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08547edeec8e522d84b40fd8236878da54c888ede86588be3913a1c37cd2b245 [email protected] implements a Telegram bot that accepts text messages from remote parties and passes them directly to subprocess.checkoutputcmd,...

MAL-2026-14130 Malicious code in httpz-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc httpz-requests exposes a Telegram bot startbot, runcmdenc, httprequest whose message handler executes arbitrary shell commands on the host running th...

MAL-2026-14129 Malicious code in plugin-react-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c068ede55759ccbff349be0990eab7756ca43a5eed8a60a805e69e8c32626a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14125 Malicious code in @guildai-services/guildai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd47a423c934111e427e5db6e85d5f4393272e0a662818840887dffe409f1c21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14127 Malicious code in @reducers/projects (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88c280d6ec5724de44b3fafa7041f34d91e7896741e211cfc0419a1b84c6e241 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14126 Malicious code in @milleree/date-display (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2c195a06ca2577f279d5ec0939d9d958086f361f147e08b200c28786f776ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14128 Malicious code in motionspring (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d5f88ace3511b8bc1e45478ab620bdf9fead63cf9e3a1ef19e4b815093d698b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14124 Malicious code in alphazone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fd365bfb46c45371bec3fb53e2e37be369a42ac12a10b3c8ca6ffec7dc604bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14123 Malicious code in @oyo_tech/oyochat_user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e @oyotech/[email protected] is a dependency-confusion probe. package.json declares a preinstall script that runs node -e...

MAL-2026-14119 Malicious code in bcc-design-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f25ef58a44d6da495f8f9cd06686303901d391069000f5a10d09694b68241e2 [email protected] declares a postinstall script node./notify.js that runs automatically on npm install. The script performs an HTTP GET to th...

MAL-2026-14117 Malicious code in bcc-design (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d36ad8d761b526fd22c960a4d7ffb2a11134996e031535e56865e91135b3be80 [email protected] is a dependency-confusion beacon package published at an implausibly high version to shadow an internal package name. On npm...

MAL-2026-14118 Malicious code in core-tailwindcss-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67bbda0dc4bcf5478f2edd6a243b1f289f2b0471f950b4362f21b5a6344cdd83 Package is advertised as a Tailwind CSS utility but ships no CSS utilities. index.js exports getPlugin which fetches JSON from the hardcoded bare-IP...

MAL-2026-14120 Malicious code in blastradar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eccd07c931ee578e1201f5fbb7f4610fd5291202c0fcee2b30c959c80c871e The package's index.js loads childprocess, https, and fs at the top level and performs an HTTPS POST that carries host- and installer-identifying dat...

MAL-2026-14121 Malicious code in sui-move-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760bce82610adadda6538b9ab04627b71b66c3816fe63f8e1a8f629ce4b4aaf4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14122 Malicious code in ulebkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f3ed8bc4169d291326b95c6c7201e27698ea05a15d82b9e1b095c64f571ac9 index.js unconditionally requires./perf.js on load. perf.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, /.aws/credentials, /.aws/config, and...

MAL-2026-14100 Malicious code in socks5901 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3 During import, package exfiltrates all files from "/sdcard/" --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-14113 Malicious code in sui-move-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cceb15de1ddd23a55de69afe59a00c79dcc23f8ce3dfed33592d781bddfbb5a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14105 Malicious code in bcs-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd676f5c862ca8046400db51b6ccdc4eea5c3fa913548c1eb7679a22653a3f05 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14112 Malicious code in sui-gql-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd108608caad4cab6ceb193a4711e40f7007114ddd01bcd5b8c3a958c1c70520 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14109 Malicious code in leb128x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb3862797564b06cd20320cecbdadcdd30bd5506e9afc09ed1f2ce225c22e5c8 The package presents itself as a LEB128 encoding utility, but index.js unconditionally requires perf.js, which on load reads /.sui/sui.keystore,...

MAL-2026-14110 Malicious code in reseller-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5e549688dcd67cfcc86be1c65c7831f7c730036626c41484332cf7dca2d7fee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14107 Malicious code in club-sauce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a5b5234f79f70ac18cfbd80c2e2cf922e3f151b38d807627feb087a35f7c645 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14111 Malicious code in sugarball-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14106 Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

MAL-2026-14114 Malicious code in userbotjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0afcc62f361549813f605462124928c14c5228ba1d87e19adea38cc5e13c3609 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14115 Malicious code in userbotjs-jun (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 874844845d90204790121d44266ee3bd0da34f2bd84e7905cedba27583c71b99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14108 Malicious code in junofficial-userbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 167c22b6f010e1ce90c0a5e1ac3ea0d0b6340486f3c83df4d5f2342724575b4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14101 Malicious code in @junofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce5b57f62207e6e6dc46974d3544def4d670aeb1837363b83c4e9b4f49ccd0dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14104 Malicious code in autoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43e2f80495807b8e77521a7d5bcba68a0ba790db0ca08a3d14450f568165217d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14103 Malicious code in a.poltoradnev-package-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d1659d9d1386305bd1c623cc2e3643375f4e14ad279ece4f3df684ecd53ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14102 Malicious code in @siwatfa/yorn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a80ba4dd71c991ac9dfc64dd9954a5ad7a83d2b67cc7807dde863872f9324b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14116 Malicious code in runtime-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 947c67500453c29daa330afc7d05e5ab5eb6405c4da235d1d0b408b247489832 The OpenSSF Package Analysis project identified 'runtime-health' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2026-14070 Malicious code in @ai-vertical/ai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3daa0f3fabdeebe3db0146233d623d65ae16aea601e54fd6519a160db5af8ee On require/import, index.js fetches a hardcoded GitHub Gist gist.github.com/aiverticalsolutions/7676451d2f972137d2482c4a8937a77a via the api.github.c...

MAL-2026-14069 Malicious code in kb-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d69143a6cdc0a652f91210034751420f7ada3db2a13d81d9e635e3a63333dc5 On import kbai, the package's init.py triggers kbai.utils.callback, which starts a background thread that collects installer host identifiers hostnam...

MAL-2026-14068 Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

MAL-2026-14067 Malicious code in upload-to-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...

MAL-2026-14066 Malicious code in akamaijs-sensorv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267 The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment...

MAL-2026-14065 Malicious code in akamai-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178 Package published under a name impersonating Akamai's sensordata anti-bot SDK. index.js contains a /... / comment whose body is encoded in invisible...

MAL-2026-14064 Malicious code in @finaxis/common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8 Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 READM...

MAL-2026-14058 Malicious code in adxaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9 The tarball stages an obfuscated JavaScript payload i.js, with an un-obfuscated copy in original.js that gates on window.location.href containing...