239556 matches found
MAL-2026-13772 Malicious code in camelot-ammv2-core (npm)
camelot-ammv2-core is a malicious npm package that impersonates Camelot DEX's AMM v2 core contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the...
MAL-2026-13773 Malicious code in camelot-ammv2-periphery (npm)
camelot-ammv2-periphery is a malicious npm package that impersonates Camelot DEX's AMM v2 periphery contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true...
MAL-2026-13739 Malicious code in ethereum-vault-connector (npm)
ethereum-vault-connector is a malicious npm package that impersonates Euler's Ethereum Vault Connector EVC protocol. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js |...
MAL-2026-13777 Malicious code in upshift-finance (npm)
upshift-finance is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk "Upshift" is the DeFi product name used throughout the real SDK, e.g. app.upshift.finance. Its published 1.0.0 body is byte-identical to augustdigital-sdk and...
MAL-2026-13734 Malicious code in @aerodrome-finance/contracts (npm)
@aerodrome-finance/contracts is a malicious npm package that impersonates Aerodrome Finance. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the code...
MAL-2026-13774 Malicious code in augustdigital-sdk (npm)
augustdigital-sdk is a malicious npm package — an unscoped brand-hijack of the legitimate, actively-maintained scoped package @augustdigital/sdk. Version 8.20.1 was copied verbatim from the genuine @augustdigital/[email protected] release published 2 hours earlier to masquerade as a legitimate mirror or...
MAL-2026-13771 Malicious code in boring-vault (npm)
boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...
MAL-2026-13776 Malicious code in upshift-config (npm)
upshift-config is a malicious npm package — a renamed repack of a brand-hijack squat of the legitimate scoped package @augustdigital/sdk. The version 0.5.14 is fabricated to imply a release history the package does not have it is a first-ever publish. Its body is byte-identical to augustdigital-s...
MAL-2026-13770 Malicious code in @telekom-ods/react-ui-kit (npm)
@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...
MAL-2026-13775 Malicious code in permit2 (npm)
permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system whose legitimate npm distribution is the scoped @uniswap/permit2-sdk, advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published...
MAL-2026-13931 Malicious code in @dreamguyxeon/libsignal-node (npm)
npm/@dreamguyxeon/libsignal-node has the same import-time supply-chain tampering as @dgxeon13/[email protected]: on require it patches @whiskeysockets/baileys lib/Socket/newsletter.js with remote-controlled consentless WhatsApp newsletter auto-follow code fetch DGXeon13/strings after 120s,...
MAL-2026-13932 Malicious code in my-auto-follow (npm)
npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from...
MAL-2026-13929 Malicious code in @dgxeon13/libsignal-node (npm)
npm/@dgxeon13/libsignal-node impersonates Signal's libsignal Node binding. On require of index.js, after a short delay it runs install.js installNewsletterAutoFollow, which locates @whiskeysockets/baileys under nodemodules and overwrites lib/Socket/newsletter.js with an embedded payload that...
MAL-2026-13930 Malicious code in @dreamguyxeon/baileyx (npm)
npm/@dreamguyxeon/baileyx is a Baileys WhatsApp Web API fork with the same undisclosed remote-controlled consentless newsletter auto-follow as related DGXeon packages. In lib/Socket/newsletter.js, after session setup it waits 120 seconds, fetches...
MAL-2026-13712 Malicious code in bigtime (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...
MAL-2026-13714 Malicious code in @sqlite-labs/nodesql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77614b62a827121762f2140a37b26e96408f18c0ccd122069c2ae311918541ef @sqlite-labs/[email protected] ships an index.js that is a copy of the feross/buffer library with a single injected top-of-file statement var ins =...
MAL-2026-13713 Malicious code in @sqlite-labs/createsql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...
MAL-2026-13711 Malicious code in plp-contract (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e3ef373acec23f98bde23ab356fd83a31773db1aa9a01ec2505775893e990fb No install-time, import-time, or runtime code paths were identified that read installer secrets, fetch or execute remote code, relay caller data to...
MAL-2026-13709 Malicious code in neutrl-contracts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b41aff3f07d1c63f5b9c6096798ce5ce7cb3b06028f1bc6361e9501c966742a0 Review of neutrl-contracts 2.0.2 on PyPI did not surface any code paths that exfiltrate installer data, execute attacker-controlled payloads at insta...
MAL-2026-13710 Malicious code in neutrl-core (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a9fd4e018ce439288641c2bb6098fcfab811252142bcff5280e2b842aade9f providers.py in neutrl-core 2.0.2 contains a covert routine named handleanalytics that, when a JSON-RPC response includes cfg == 'collect', scrapes...
MAL-2026-13725 Malicious code in spoint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c32e6b328bf731b6269e720e0fda2dec5264452ef04d406fde5296413424525 Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator source files...
MAL-2026-13726 Malicious code in svelte-kit-streak (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b52621d72853042287f8152d66c3f465b510af17f7b16283d9ab64ee01dc13cb [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating exfiltration, install-time remote...
MAL-2026-13724 Malicious code in kit-map-streak (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 786d48d847985123d42405ec9cab1475f236ca39fb9d84534c83db29834fbd58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-13723 Malicious code in godot-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edb0e7385ab0574f7223206d79822362c142c664b0aed0ae5a00546b6bb38ef4 lang/gdscript.js appends a hostile IIFE after module.exports that runs when the module is require'd reachable via lang/loader.js and test.js. The...
MAL-2026-13727 Malicious code in tailwind-elements-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75f8605cff87e89b9f1a50c65fc27af278335cf414a8b4fb52ea4090e9fdd71b No malicious behavior was identified in the package contents. The package name resembles popular Tailwind-related UI libraries, which can indicate...
MAL-2026-13722 Malicious code in fsbrowse (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7866973ba5f2971efedd027cce57aefb5b8f27d7304de323261832c29bbd82 The package's main entry file index.js contains a legitimate Express file-server module followed by a unicode-escape-obfuscated IIFE appended after...
MAL-2026-13718 Malicious code in @sqlite-table/sql-creator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95ae7afdf9e201794a4bd58bcb8c0adaccc743520ce5530a204fc2253b0d3e26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-13716 Malicious code in @sqlite-prime/nodesql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5b84b0145aa2612302c7153b5848582cdda2f6c88c802dfc0618cd376dd617 @sqlite-prime/[email protected] ships a verbatim copy of the well-known buffer library as its main entry index.js with a single injected top-level...
MAL-2026-13717 Malicious code in @sqlite-table/schema-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4db5d5f6801c8d18fb40f84808a299ea8d8e251da32260b4fbf264a290f44e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-13715 Malicious code in @sqlite-prime/createsql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01e898636f16aeaf0f90bb35efaccc41186222d35f564d37c65dd1aaf471e03e On require/import, index.js constructs a GitHub Gist API URL https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90, owned by user...
MAL-2026-13720 Malicious code in eth-library-toolkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff [email protected] presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo —...
MAL-2026-13719 Malicious code in commonjs-assertion (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c3fd028dc7e2493e59a3f81bb26702030dac0a64a42d845bd23ea116352f94 Package presents itself as a chai-like assertion library. index.js uses hex-encoded strings to hide the identifiers 'childprocess' and 'node' and, on...
MAL-2026-13721 Malicious code in eth-library-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d64f85fbcbf82d877cbbbf470142d3c5ebabfc9ba8bca5a6f8fecfa70e02e13 No a static rule matches and no traced code findings were produced for this package version. No credential access, install-time network...
MAL-2026-13707 Malicious code in polymarket-stake-mathss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef71354e27f0e5798fee884366776d5b76ba0df0122148d1f4f7aeeef42b45cc Typosquat of polymarket-stake-math double s. The postinstall script install-check.cjs resolves a bundle URL from the package.json homepage field...
MAL-2026-13708 Malicious code in xerohub-discord-voice (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a9835e5102552e4f3787b7a957edd56441057093ee78e4da0acf48bc18bd32 xerohub-discord-voice advertises a startVoiceJoinerconfig API for joining a Discord voice channel, but its sendTokenToCreator function silently POSTs...
MAL-2026-13706 Malicious code in neverthrow-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd Package [email protected] is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs...
MAL-2026-13701 Malicious code in chai-as-format (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c The package's index.js unconditionally requires./lib/config, which is a 4MB single-line file consisting of an obfuscator.io-style hex-encoded string...
MAL-2026-13703 Malicious code in chai-as-promised-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be02bee1e19ad24ae6091f0793dc22af62e54030388bbdc7d1aa29b078ac17a5 The package name mimics the widely-used chai-as-promised assertion helper and reuses its README/description. lib/chai-as-promised-plus.js defines the...
MAL-2026-13700 Malicious code in chai-as-deployer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...
MAL-2026-13699 Malicious code in chai-as-bench (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 487af469d8de2a3caa5e798df3a5d56e59b795c1ddc106abd1d38ed855b6fb17 The package presents itself as a chai plugin name resembles chai-as-promised, manifest description references chai assertions, but ships no...
MAL-2026-13702 Malicious code in chai-as-map (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e93684202a75938b3139b209943cf55c34ea8ff9a215a6ead907e36d8ab953 The package presents itself as a chai-related utility name chai-as-map, keywords logger/stream/json, description referencing vulnerability management...
MAL-2026-13704 Malicious code in chai-tracker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d61869c26ad8015b88350d312fa37f5e18d536794ce5d8c46bf4239b2154b1a9 chai-tracker mimics chai-spies matching name, README, and keywords but declares peerDependencies on dbconnectify pinned to 'latest' and axios. The...
MAL-2026-13705 Malicious code in iconova-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4590534a7b05eb30959d9422e2ea700fb525b66b357a62f7ba1795caba4ad799 iconova-react is a re-hosted copy of lucide-react every icon file carries a @license lucide-react header; the package name is iconova-react but its...
MAL-2026-13688 Malicious code in @kuperka/chainguard-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b799ca087f4396cb295cd53012a92d10dea0c763a41c8b85e94437108ea24e4 Package @kuperka/[email protected] exposes a single payload, window.VEIL.init, that on load harvests document.cookie, every...
MAL-2026-13691 Malicious code in @rblxts/services (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f58d29f68e2d431a9a6e55f49b0441dabb7601accfecb3c1801aabd30e29d0 @rblxts/services is a typosquat of @rbxts/services. Its scripts/postinstall.js is heavily obfuscated: module names 'fs','https','childprocess',...
MAL-2026-13696 Malicious code in postcss-initial-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e88db5eb44ddcfa3cd22d46e8b6e6a1cd2e7da25a5942d35550d50f2cbbb9ea3 index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints 1rpc.io/eth,...
MAL-2026-13692 Malicious code in chai-jsonss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1fff32102bc74783cae571646ec0fd68b14c614b35a63badd814a64caa3b67 On import, index.js invokes postCallers which resolves a base64-encoded URL stored in lib/const.js decoding to https://1uznbx.s.gy/7xdQmt, GETs the...
MAL-2026-13689 Malicious code in @noobaihome/amis-simple-area-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642f206459c4677892954c26736b990c72bb01ae9383f917ab664b38d977819f @noobaihome/[email protected] advertises an AI Suda amis area-chart widget, but dist/renderer.umd.js and dist/plugin.umd.js are empty stu...
MAL-2026-13690 Malicious code in @noobaihome/amis-uni-area-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1741a7c8b780801766382499022f9aa860eb8313e4a416a5157afeb9a92f6561 scripts/install.js runs during npm preinstall and performs three attacker-beneficial actions against the installer host. First, it unconditionally...
MAL-2026-13693 Malicious code in cryptostock (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454 index.js is an obfuscated payload that, on require, starts a C2 client against https://badai.run.place: it registers a UID, long-polls...