Malicious code in @galicia-toolkit-nestjs/commons (npm)

Source: amazon-inspector eae27acb3901d275439e482d51a1451df67c1a6b2011f35881253a3fa8d2456b The package ships a tiny index.js that requires a bundled ELF at prebuilds/linux-x64/metrics.node inside a swallow-all try/catch on module load. No C/C++ source, binding.gyp, or node-gyp/prebuild tooling is...

Malicious code in @brick-v2/table (npm)

Source: amazon-inspector 1fdd2bc5b913543c62603b366fb4e1261407f63541e4b01ff7e0052e522523e0 @brick-v2/table presents a trivial Angular-style logger/table shim forRoot/createLogger/version no-ops while index.js unconditionally side-loads prebuilds/-/metrics.node on require. The native addon reads...

Malicious code in @brick-v2/form (npm)

Source: amazon-inspector 61727d51587469176de52cbc3c82a53b4572ecfc6c7f7b4c7edf534950b0f536 The package ships a tiny JavaScript stub at index.js that silently requires a compiled native addon at prebuilds/linux-x64/metrics.node inside a try/catch that suppresses errors. On load, the addon reads a...

MAL-2026-17743 Malicious code in tailwind-animatecss-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af43d6ea5b41804fed5e67e2de300fceed98d4f487c0e9675aabcfe457e87e3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17740 Malicious code in hanncap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ffc31544036fecbfe1ad24886f1c2f857a855b969b25550514bbc5dbe5a0bf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17733 Malicious code in asepxyz-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b237efd2362cabb19a1d538927608d053a0fbec1990177bf681e1984f3637c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17742 Malicious code in razamodsxasepxyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fb9a16f3dca74ebd287b9b69371219076159f7f68d3bf1d9f2b2d306702db90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17736 Malicious code in asepxyz12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e236cb25f35bff117282c886b6c949b77b0e6dcc0362b69d088fc14ad832648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17734 Malicious code in asepxyz-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9e873795c4634852530066ca11f554da84043934f246df7b3edbe868ea343ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17735 Malicious code in asepxyz-signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93a25581c0df790766c1da3c788f341c8b94ceae03e849cf512f89f1b8c1711b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17741 Malicious code in pahinuy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b0dc50f5fd68994ec471647de7ba2967f2fd3cf25094377e885e60ec6f01da9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17738 Malicious code in asepxyzxrazamodsnew-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ead2c2294eec38c18f277f87b0fe28dad253a234ad0b64d6a2ea5047a485031e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17732 Malicious code in asepxyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a030b2e7355868ec048715d3954a8dcd6689ea26675fd1a2121c5951d95c7a75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17737 Malicious code in asepxyznew (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35391863019c89ac27cfaed9c4356c6ae6ac413dd18bbc823503e7a004a146ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17731 Malicious code in @aseppxyzz12/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0c3a4c58c42cbe1dc7135a6b4ff75cf3242ba4b65463994ff78cdec19f53698 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17739 Malicious code in asepxyzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ac7652881430a88c08a69d82ffbcab4c40cb2f04f0eda3df60345e6ebc71ce3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17712 Malicious code in ig-gox (PyPI)

Importing iggox runs iggox/init.py, which decodes a blob base64, XOR, zlib after a few anti-debugging checks and execs it as main. The decoded loader only goes on if it looks like a physical Android device running Termux it turns away x86, emulators and VMs, installs requests and cryptography if...

Malicious code in ig-gox (PyPI)

Importing iggox runs iggox/init.py, which decodes a blob base64, XOR, zlib after a few anti-debugging checks and execs it as main. The decoded loader only goes on if it looks like a physical Android device running Termux it turns away x86, emulators and VMs, installs requests and cryptography if...

PT-2026-108966

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description The self-upgrade mechanism validates downloaded binaries using a same-origin digest obtained from the same upgrade mirror. A compromised mirror or a network attacker capable of altering both...

MAL-2026-17720 Malicious code in @galicia-toolkit-cheques-nc/front (npm)

@galicia-toolkit-cheques-nc/front is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...