MAL-2026-6618 Malicious code in @experian-shared/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b9781b2089d3aeafbedfe7c81af43904472553991bd7e50695ab301d4529eaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @anna-money/anna-web-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51ad1206f707247b245f3a828c780fbe27239f1fa15c8a90782617144669af5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6663 Malicious code in gel-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10116e156a97ca387656f02710aa483d0fb1e35cd29a38dba3f4c323b7eb25e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6670 Malicious code in rc-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6800b5e0006797aaa2ecc99cf3a214a4284520fd730699b82b855ff08136df9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6654 Malicious code in app-hotmart-blog-headless (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d84025bf61426d455a22babbef859c4d8e9cd9d9312bd6c93dfcdb8ad5264db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6625 Malicious code in @grappi/automations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfa70084df92420d9b31f4eb1da3b47bccc78cc677a9f6fb3ac242c857f2e925 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6631 Malicious code in @mcconnect/mcc-common-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be912fccd62d30a685cdb31baa7155b91a283043d74447d1d7099ffbaa73b1dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cmp-api-stub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64a5a4ba35daee6a6a7e344f853e6ab0fc54d4d39f3434bdd3cbc7e7f56aa766 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wac-atl-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 134ebb06205351f90ad8f5b88029b397861c8fd42c9377b993efea372edfa0f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6666 Malicious code in magwien.sys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3a05966b663e2a0426f035a1af2b211624ee83152a91f6b257cbfa6f524fbec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6659 Malicious code in cdocs-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e752c40246ae31a84c87fdd3bdc7ff7cd8eda3f7cb6765417917859a0edbd49a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6667 Malicious code in player-core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0125c3ddfa61335d33bb6254aa2542b3dc7d561dce6e8fdf7580b28b05cd710 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6648 Malicious code in @shopbop/api-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1e5f6c38f5d8b7befd57a2236e32bc2bc940467d300734af69b97f0b219cf2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6623 Malicious code in @gartnerx/gx-npm-messenger-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ac6847c5fe137311cfd7bd6bb167d54d860f11f57aa7bae17493e475f0521c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6671 Malicious code in wac-atl-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 134ebb06205351f90ad8f5b88029b397861c8fd42c9377b993efea372edfa0f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6664 Malicious code in hrb-cas-auth-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccfa589a59f63f85fca72ce4582bfa37b0b480078b00627f1e1612e0a7d8d5d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6621 Malicious code in @flipbit2-bb/scope-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b4b4d5e8e72141828bf6df5afe2300f5b9496d22f8b05491623fd699496603 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in clx-cookieparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29b7ab13cd76393ea58b540ccf13b4ab4660edb4fac210d86a67e51b45fa1d0c Package ships a verbatim copy of the Express 'cookie-parser' middleware under a different name 'clx-cookieparser' and declares a repository field...

MAL-2026-6658 Malicious code in bundrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f853223051c1cb68bc005b827209cb844bcde568473a9ff819fb34fccb042d74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dynamo-release (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of dynamo-release were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...