MAL-2026-15977 Malicious code in discord-tqr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a86833e5a36c88fc9e53ced45f2d6d0ec40357cce7377aeec0da7e1f25666ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15976 Malicious code in discord-phub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 181fb5530173cb05bf3e2d2fd37a097924d5affad4b9e3438ceef5d399b01b0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16002 Malicious code in tempjs-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4793104f666467c4b7fca75f478d830e4b7d2f80fcfb9b70fedf8733867bb35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15964 Malicious code in @yoannchb/cattract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e7abd13f1aa830b5721234537a3e473c8c59527506f8a0daeca72bc17c6e55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15949 Malicious code in @domyjs/debounce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2616c0d23fb705645957e01c76610e48bdf68c6b88de4f39df4c71ed2daeafb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15990 Malicious code in json-into-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04a5353fa099a8aecf0c34fd2d34244cc86058adb2f9a26eee4d7efe08a5b95f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in json-into-html

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-15993 Malicious code in linkpreview-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c62818bdb74e00433e1e82737807bc3c427fdcca8db39d1fff7bf6db5e7e64d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in infinity-grid

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-15971 Malicious code in btn-particles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01991d61636173b6fea5e641ca06009891d2b044b894368fab0c7610722ff070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15985 Malicious code in google-img-scrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86caa3dfd7fbfa99dfa8042e4792f31346c57427e7eb83cbc468b5a14d4c0e14 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15998 Malicious code in onetime-rnd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f949fd70a8bdf3174426072e1eac3d15e0b00c6ec57e0d3cf0a3ef45ca79ea49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15986 Malicious code in iframe-to-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc607fb5b68fa9cd9a186110b72bea322a0a74ad96f6e8ba53105ed89e2388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15989 Malicious code in jimg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c510cbf9c5077091b3b415ba9ce624c06a1487f6fbe3a74e638d921f8b2ec440 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15996 Malicious code in muswish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 544f09e40055924b758a4908557e238acc44e86f9c63ad51548df24bfbb368a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15992 Malicious code in lazy-attr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6e9ec6f580e2ecf0b9cf61f677666b18211e7056ffd5b3cb775f21356d0e351 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15950 Malicious code in @domyjs/domy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 673f8826708fe5d043b6e2cff5ed4d3acd6f71b168d6ab486d250abd0429bae6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16000 Malicious code in pipipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6069e53629de29530019a5d19c7cbf7dc8d490c039130fdab2b2f264ac23728c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15965 Malicious code in @yoannchb/langy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47b5b900f80a042ffb1a59e811c0c1325324b56b01f12e2b6ac291b12760698b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15978 Malicious code in drive-album (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7b552aab413e10d8cc2363896d1735041227c764470db3de7cde26705996b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...