MAL-2025-6177 Malicious code in lint-pr-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7a7398205d96f4d045fedf2fbd41ba545c40048a2e9683747ab8bec7ac77a1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6004 Malicious code in winston-compose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 981347a4b88ce00ab42b1a3f93b56d89cf28282070c617325e304221c6ce4882 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5883 Malicious code in @web-kit-package/grab-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b40f792f041cb54fd538d312324aefe4be963bdebc3734132184a9c3b4c875fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paypal-invoicing (npm)

Malicious package. Collects system info, exfiltrates data to hardcoded IP, runs code during preinstall, and attempts to hide activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd66aabb4b40f49dc7ef8bda42a33f705beb6def65601b8fd3025c7e055bc2e6 Any computer that...

Malicious code in flow-playground (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14d20a3a54d31a33e86fe7ad68eddc9fbfb2b2d94bc3787b6d963b290d2fbdde Any computer that has this package installed or running should be considered...

Malicious code in fxa-auth-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 001dcafa5fa85d6d5358a1a79909f92615e17cae27329f2b1fea9c1cc51d41ca Any computer that has this package installed or running should be considered...

MAL-2025-6089 Malicious code in fxa-auth-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 001dcafa5fa85d6d5358a1a79909f92615e17cae27329f2b1fea9c1cc51d41ca Any computer that has this package installed or running should be considered...

MAL-2025-5734 Malicious code in vite-meta-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38fbb013e3df2485e72ad722dfab14b0295214d9f631913350b0eec0d658469a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5700 Malicious code in htmlbars-inline-precompile (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c4a212f0a71820f5e5ac4def1449d454a87b95082eae0de676cc3e27006831a Any computer that has this package installed or running should be considered...

MAL-2025-5813 Malicious code in glean-mcp-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2116bc0a7e97b50629b8572a3e7b46cb436c7732be15b4aa9c87835444eff955 Any computer that has this package installed or running should be considered...

Malicious code in web-app-express (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ee5553287313031193a1d7e8bb9fb1fe49931cdda2ce085efc8360ea1b18d01 Any computer that has this package installed or running should be considered...

Malicious code in with-shadcn (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01233cb16b11624de4b6a0eb8110923a4611ba7c757ee2a9bdb46370b77099d6 Any computer that has this package installed or running should be considered...

MAL-2025-5825 Malicious code in seller-assistant-commons-fe (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ce5fe0219875b1f9631f9bbd7ed53592500782697d8a2d2255f1e0fbce9398b Any computer that has this package installed or running should be considered...

MAL-2025-5594 Malicious code in rjs-test (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff96ebaa9a7e9bad85ca95367b0a36f1c3374ba9f80ce3fc5aac0a53671cb5e7 Any computer that has this package installed or running should be considered...

Malicious code in grafana-github-datasource (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 756c8548e63d376422abc6c7f12d97177a86331d9e8f4321c863bf8eeb5bf67a Any computer that has this package installed or running should be considered...

MAL-2025-5565 Malicious code in melichat-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be50c9968d324f01849a45b03ed727ed17bdb07f26f70fd0957996a883370a35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5523 Malicious code in tools-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8430b3270cb2769c8afa5686cc7ed09d5be1fe3a5d680fd3887e3b2a1279e3f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5338 Malicious code in emerson-angular-trove (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3710a484d9498defd18d6636486ebe053b8e10147655e6735b1d3769cb3a8676 Any computer that has this package installed or running should be considered...

MAL-2025-5337 Malicious code in themeone-animate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e147615a6d4e51665cb5f31f094f28cbb4c79a9c3ea92899c8a0a37ea40bb4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5366 Malicious code in betsson (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0a75e59ad3bc711c1c85bcaa0ffa95881a78cfb3542b431244d3af5e80b3e48 Any computer that has this package installed or running should be considered...