Malware in @myorder-frontend-commons/analytics

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @revizahoshii/hoshino-media-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17818 Malicious code in @alipclutch/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a547c784c13d1a96d07b03039a8997721e06467bda6794a2a1cc14a2cb68ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @fhkryxv/baileys-new

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @fhkryxv/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @fazzcodestudio/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-animatecss-form

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in clickfix_npm_delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d The package has no library surface. package.json declares main: index.html and the tarball ships only that HTML page, whose sole purpose is a ClickFi...

MAL-2026-17647 Malicious code in function-color (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 551ba64ea86ca7d7839dcd058b2c567604c534134e2a6e13f84af340c2db4aac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vectorizers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1082db2b4593a2b60921a85d2f4c760a294a67b1a48007959d75d61f670dc87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in serpacksven (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89aa9ce877a176ce5c26aec2bce6e397ad287a6f26f625870cd5d6a5bef60cc9 The tarball contains only package.json and json.txt. The declared main index.js is absent, so requiring the package fails — the package is not a...

MAL-2026-17625 Malicious code in serpacksven (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89aa9ce877a176ce5c26aec2bce6e397ad287a6f26f625870cd5d6a5bef60cc9 The tarball contains only package.json and json.txt. The declared main index.js is absent, so requiring the package fails — the package is not a...

Malicious code in dzyhaxz-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c8e7ca99c316f4b011bacc98bd321fb6e0afab999695d94c2cf41b1bff48b17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dzyclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8bd1abac47f016ac53777bcc08d76d15a48330f1c53931e61d6704ce6f3398d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17426 Malicious code in kartykgithub-ph-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e9463feb27a295ad0b7136837e12908bc8d668e0b7bbd70309c760165f071f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17424 Malicious code in kartykgithub-ph-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1a43aa1b797b98f578426b682f248b9e54bfd67acf5fc4030455c7d7228bc92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @firelordzuka/pulse-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8247d4cb8f4973f229f36053baee4350a10058ec5290e6fad9659ebe1c04f8a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in link-status-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38a885003c985463c91366a4a8615fab9c6e4d876afdf33493c3e0463066cbdd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sk-lib-enc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50da04ce2032df71a298f83648d49995542c28b18052f48cf38c721fc6d80f8f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...