329926 matches found
MAL-2026-17828 Malicious code in @revizahoshii/hoshino-store-mongo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbbe1a1b8523eee7d05bc6e5c5dfa9e65fd25e1c42b9fed34f645048dba47b6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17826 Malicious code in @revizahoshii/hoshino-media-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65fe484d1302a25cb129e7fb56ebbf059f4c9469a85abc10ac695e605e34dcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17830 Malicious code in @revizahoshii/hoshino-store-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 413598986f6891c8b092769e99f8995809b19b477eb3dff36899d857aec516ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17832 Malicious code in @revizahoshii/hoshino-store-sqlite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5be1bfeb40b1b25c136a73036ef88cd35ed77e2662ca3e69235b4c3b081ff9cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17829 Malicious code in @revizahoshii/hoshino-store-mysql (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0b408e63765025424d6570c3bd05bd6e01534734e6613fabee59696d11d1f15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17388 Malicious code in baileys-xbats (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17818 Malicious code in @alipclutch/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a547c784c13d1a96d07b03039a8997721e06467bda6794a2a1cc14a2cb68ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17353 Malicious code in @fhkryxv/baileys-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17352 Malicious code in @fhkryxv/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17821 Malicious code in @fazzcodestudio/fbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02d04f078ee45b434a2f48ebecea2fc18811a6830ab2e24baccea6e577baa0e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17842 Malicious code in @we3js/framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b363085b57cf1cfd50b00e3845bdd50122e4e2f137a124def03f5cf59e7b23b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17820 Malicious code in @fazzcodestudio/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d9a7ab4b8ee5eb018dda5e7d3b273e9bc690364e24d4ece93d1107cfa791d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17441 Malicious code in @fazzcodestudio/wa-web (npm)
This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...
MAL-2026-17822 Malicious code in @fazzcodestudio/mediaformater (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2777e6e1aff40e693fdc759b07014c5ad7c6b24fbd40d3b3cdb8d2f32c6249ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17819 Malicious code in @badzz88/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eafa4b306df1ba72117512af8f1b676cd101c93bac67d887418f318b39efcc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17340 Malicious code in @astracode/byles-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17823 Malicious code in @modss/libsignal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78daaf334cc6740c70b214309f4bf742a863b8c3c421076490cdb84790dd9550 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17814 Malicious code in @mikudeveloper/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4749ec89d8c51729fbd97994a6a035ab229a56bb1094c4c47d9a3d68df050711 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @lekzo_dev/amprem (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2a03e817ffe43fd777ac600302898da7b30ad7653e1c57bea618e9801dba3b Package presents itself as an 'Alight Motion Premium Activator' and exposes an API that POSTs caller-supplied email addresses and 'magic link'...
MAL-2026-17813 Malicious code in @lekzo_dev/amprem (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2a03e817ffe43fd777ac600302898da7b30ad7653e1c57bea618e9801dba3b Package presents itself as an 'Alight Motion Premium Activator' and exposes an API that POSTs caller-supplied email addresses and 'magic link'...