MAL-2026-17535 Malicious code in @anguar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 428f991afc1ada001d59a546b8290c039dc16c98f6e497346acd87b8c08034eb Package @anguar/core impersonates @angular/core: scope name differs by one letter and package.json name, description, author, and repository metadata...

MAL-2026-17532 Malicious code in @abgular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c4c8470613dc3a49e249f1a9f91bc756bb9b4323c78268b35816f07e78a0a9b Package name @abgular/core is a single-character transposition of @angular/core and copies that package's description, author, and repository metadat...

MAL-2026-17538 Malicious code in @angulr/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c24dfd4b0a686b9056ff662e6fee53edfe23c7a94a5edf93fb4cace176216518 The npm package @angulr/core masquerades as Angular's @angular/core by cloning its package.json metadata description 'Angular - the core framework',...

MAL-2026-17541 Malicious code in @anuglar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f23ef78cc88817166cff7f8fdf3f1839c610880d960d9394e286da232058f98 Package name '@anuglar/core' is a one-character transposition of '@angular/core' and copies the legitimate package's description 'Angular - the core...

MAL-2026-17540 Malicious code in @anngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93d2078e85dc301d6b0299c93ff5e0e5e2c717290e88f18de85fce6554f2d027 Package name @anngular/core double-n impersonates @angular/core, copying its description 'Angular - the core framework' and author 'angular'...

MAL-2026-17539 Malicious code in @angupar/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61d3f74118d7ca9e50d79028ad472e56f68c8f86111fb03973a0c01a00b4cd84 Package impersonates @angular/core name @angupar/core, author field "angular", repository pointing at github.com/angular/angular, README copied from...

MAL-2026-17562 Malicious code in internallib_v923 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d02d4c28dbcb2db331a6da7dba2476e3b7daf4f4d53d51d76d79ad4732d28a4 index.js exports a command function that shells out via /bin/bash -c to curl a payload from reverse-shell.sh and pipe it to sh, yielding a reverse...

MAL-2026-17544 Malicious code in @qngular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e83437986b94381cddff72267bc53907d980e1b14dbfef9123aa47f5ed664664 Package @qngular/core is a one-character typosquat of @angular/core and copies the real package's description, author, and repository metadata. The...

MAL-2026-17536 Malicious code in @angulaar/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33d4a58c855f9b549d39f194483ee19730552bbb47a279f73237c8a403708d20 Package name '@angulaar/cli' double 'a' is a one-character edit of '@angular/cli'; README, LICENSE headers, and source files are copied verbatim from...

MAL-2026-17533 Malicious code in @anfular/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eefc706854c122c96c898da5d4db285f26e31430f25451e5d1073a31db5e5341 Package @anfular/[email protected] is a one-character typosquat of @angular/core, with manifest fields impersonating the official Angular package scope...

MAL-2026-17531 Malicious code in api-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8232ec7756422686c2bce805fc87821e61a5bd9176cdb2fe7c3190fd2b2eae2 The package declares "preinstall": "node preinstall.cjs" in package.json, and preinstall.cjs is a single-line 187 KB Function"pbeIUC", "…" invocation...

MAL-2026-17504 Malicious code in dotenv-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51d22963a1f1fabe3a8b3f54efcb5053761d385486093200765745297ac2bd16 The package impersonates the dotenv API but on module load and again when the bundled CLI runs invokes a function named dispatchAnalytics in...

MAL-2026-17505 Malicious code in dotenv-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 254f0bcbb8014fb07414eb0b41a898deac682aa8c8b7a8541a0f7538ac274f9a The package is published as 'dotenv-promises' but its bundled manifest declares the internal name '[email protected]' and mimics the dotenv API...

MAL-2026-17501 Malicious code in a11y-tabindex-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce127c3e1cadd4f544a5f2580f2db030e3d9e3667d7b0e3399d85b59eb354045 a11y-tabindex-manager ships thunderboltRegistry.js, which executes an IIFE on module load that runs a series of local shell commands cat /etc/hosts,...

MAL-2026-17503 Malicious code in dom-focus-sentinel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7baf5178b3cd02ae8e6e2c01e8cf305fd9670118428c4d3ef94ac0caef6fc4e8 thunderboltRegistry.js runs an immediately-invoked function at module load that uses childprocess.execSync to run host reconnaissance commands whoami...

MAL-2026-17509 Malicious code in hardhat-roof (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26 The package presents itself as the pino logger — README, docs/, index.d.ts and LICENSE are copied from pinojs/pino and keywords advertise 'fast,...

MAL-2026-17508 Malicious code in hardhat-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02d908da8470ad86669b080d267b57174ccd77e5fd6ed2c371c430d98e869f2b [email protected] is published under a name resembling the Ethereum development tool 'hardhat' but ships README, type definitions, and docs copied...

MAL-2026-17506 Malicious code in hardhat-ftp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e916c23a0efbd49d3cfcd5993957df7afbade3f454925d0672acc8c9f68245c The package's declared main entry index.js unconditionally requires./lib/config, a 4,499,968-byte obfuscator.io-packed file 26,234-entry string array...

MAL-2026-17507 Malicious code in hardhat-jsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1 The package is published as 'hardhat-jsx' but its metadata, documentation, and lib/ layout impersonate the pino logger keywords...

MAL-2026-17510 Malicious code in internallib_v275 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c1c6d383b3defb01da235e39e08ce56276d887e63d900aea2ee689836f71b4 index.js exports a command function that invokes /bin/bash -c to curl a reverse-shell payload from reverse-shell.sh targeting the hardcoded host...

MAL-2026-17512 Malicious code in lite-matte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7b0ae9e42c334c1c22627e60add7a2c5a0d558a2ab65a3af0043e27bb0e686 package.json declares "postinstall": "wscript.exe 4444.vbs", causing npm install to auto-execute a 765KB Windows Script Host file shipped in the...

MAL-2026-17513 Malicious code in lite-matterr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc9b5f5edaae9103fd26de7cb70e661d78d6948dc3c519fec6b4b62fd471fbfc [email protected] declares a postinstall hook in package.json that runs wscript.exe 4444.vbs on npm install. The bundled 4444.vbs is a 765KB heavily...

MAL-2026-17511 Malicious code in lite-mater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 532663c4102d3cf7310e29ca1eb2b389c5c32c1e541da219b7c4364968f4e807 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs automatically on npm install on Windows hosts. The shipped 4444.vbs...

MAL-2026-17516 Malicious code in oleh-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2aebc282014a7dfa6ef1726083d23bcc9cc3eca76c814d4e775b7b10021545 Package [email protected] is a credential-harvesting phishing kit disguised as a wallet-connect modal component. It renders fake...

MAL-2026-17514 Malicious code in minimal-a11y-contrast-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance...

MAL-2026-17515 Malicious code in monitoring-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 703c1e796904571c9f0d08a4769a5f7e25a646483b4a66815a6ddc420ae0ecee The package exports an Express middleware monitor advertised as a monitoring tool. On every response finish, the middleware POSTs the inbound HTTP...

MAL-2026-17518 Malicious code in postcss-gap-fallback-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b54d5bd893bc377a77503059998e01ae3e338fd4d8ddac6fe2d7c71a3157cb5 The package is published as a PostCSS gap fallback utility but ships thunderboltRegistry.js, which executes an IIFE on module load. The IIFE runs...

MAL-2026-17517 Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

MAL-2026-17528 Malicious code in tiny-viewport-unit-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34c221d8f8f0fedded27bfc22763912ffd96e9f3d1b2c08932e054ed418f493e The package ships thunderboltRegistry.js, a module that imports Node's childprocess primitives and executes whoami plus repeated ping commands agains...

MAL-2026-17519 Malicious code in promises-dotenv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 146d9688d00e8fa785e2fb62976f0dad169e8055c6c92d3795536cc63527c640 [email protected] is a typosquat of dotenv-family packages that executes an obfuscated payload at module load. On top-level require of the...

MAL-2026-17520 Malicious code in rgx33-css-grid-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 320488b79c9000782e398425aa1a2fddba7f29a487913bbb2fc2019405c078f5 The package is published as rgx33-css-grid-utils but exports a set of module keys matching Wix thunderbolt internal registries thunderboltRegistry,...

MAL-2026-17523 Malicious code in studiocode_tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 261d413c0847b530c9a452c209c25e0a7d9123f9b0f20b26d0afcc41a929c74a package.json declares a postinstall hook that runs wscript.exe 4444.vbs, auto-executing on npm install on Windows. The shipped 4444.vbs contains...

MAL-2026-17522 Malicious code in studiocode_eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49b1af8bbf0463bb38d3049e59c28b0dcc8d2e3e5ef54611b4e77bddfdd36dc package.json declares a postinstall hook wscript.exe 4444.vbs that automatically executes a 765KB VBScript shipped in the tarball on Windows...

MAL-2026-17521 Malicious code in rgx33-flex-layout-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02200327d66cf0661b787f58049b55b5fbb95dfb76fbb81a679cc71439bd85eb Package name and exports thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, etc. impersonate internal Wix thunderbolt registry...

MAL-2026-17525 Malicious code in tiny-css-token-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee63fae51fceee7c4d3c5051e191e477ca9bb8302f6fc4d3d07f5446951efa0f Package is advertised as a CSS token parser but ships thunderboltRegistry.js which runs an IIFE on module load that collects hostname, pid, Node...

MAL-2026-17526 Malicious code in tiny-dom-focus-trap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84262096595a1e0ce09bbaa359930cd07cf420cc72545174ddc4f12c60bec962 The package is advertised as a focus-trap utility but thunderboltRegistry.js runs an IIFE at require time that uses childprocess.execSync to run...

MAL-2026-17524 Malicious code in tailwindcss-forms-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 587d9a389f35a8ec2d3ed714c90f7daa43feb6875f4ce2e4280f5ce19569d895 The package name tailwindcss-forms-styles mimics the legitimate @tailwindcss/forms plugin, and its src/index.js copies that plugin's code verbatim as...

MAL-2026-17527 Malicious code in tiny-focusgroup-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c6d210f6c61d0ec49fac4bf487a2d71966b1f3dd59653d8a8fdf12e04f9b306 [email protected] declares itself as a focus-group accessibility helper, but thunderboltRegistry.js runs an IIFE at require time that...

MAL-2026-17530 Malicious code in wcag-color-a11y-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b6e72298f32298d6558f5d52eb7a9d5185b37fe8df14748bf61d6686dde1cb3 Package is advertised as a WCAG color accessibility helper library but ships thunderboltRegistry.js, an IIFE that on module load executes shell...

MAL-2026-17529 Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

MAL-2026-17343 Malicious code in @bellaxchuu/crystalred (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17383 Malicious code in @xatancchii/velycxbail (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17404 Malicious code in saturn-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17405 Malicious code in shadowmd (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17498 Malicious code in @kibt/www-nuxt-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of...

MAL-2026-17496 Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

MAL-2026-17495 Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

MAL-2026-17502 Malicious code in botmaker-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86fdc86c67d202ca9938942ef7786534d1b72169187cce13b1cefd8899fa54aa On npm install, postinstall.js collects the installer's hostname, username, current working directory, architecture, platform, and network interface...

MAL-2026-17473 Malicious code in chai-as-testmode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af5e91a44a2eb0773df19fce2096660c285bafbe846a5f09d8bb25ff0eba22b2 The package masquerades as the pino logging library README badges and lib/ contents mimic pino but ships a dropper at lib/initializeCaller.js. A...

MAL-2026-17486 Malicious code in css-scroll-state-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cffa0affc34bac3fa24fcc7c67aae4d120066f4f856cb8b637bc04c6ca9d482c The package presents itself as a CSS polyfill but ships a payload file thunderboltRegistry.js that executes an IIFE at require time. The IIFE uses...