MAL-2025-5743 Malicious code in actions-experiment (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3571367d4274d4ca5d5c2cd7b400c40b4d656c2c58fb0746e8372cb24910c5b The OpenSSF Package Analysis project identified 'actions-experiment' ...

MAL-2025-5818 Malicious code in playwright-e2e-testing (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1947219a5f6bf4374f28676075008bd3dc532f9ffde90b285e73fcd418a198c4 Any computer that has this package installed or running should be considered...

MAL-2025-5801 Malicious code in @rupahealth/design (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0616aa94e7e7f933fb1f912840b3ec202980dde2d75d689d36e2d3cee1a22cec Any computer that has this package installed or running should be considered...

Malicious code in mttdocs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware beaa5b8141bfc9ba6d1eaaa989a534c5cfc5c7b84c82e6c3ed0c38d5112efbe4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5766 Malicious code in bazel-kotlin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68e72bd563ced782c2a9514e4b3c995c7232eb432728faca3a7dcc9ec8f64ad2 Any computer that has this package installed or running should be considered...

MAL-2025-5633 Malicious code in calling-an-api (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e35c18add1f54ce7dfa19f1c98983a68e10d2796262bd72bf8233fe7e6276aae Any computer that has this package installed or running should be considered...

Malicious code in iwf-typescript-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35758863836741b6af571432b4354ae16c72c1fcc720cae04dfb0c6506249e40 Any computer that has this package installed or running should be considered...

MAL-2025-5630 Malicious code in iwf-typescript-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35758863836741b6af571432b4354ae16c72c1fcc720cae04dfb0c6506249e40 Any computer that has this package installed or running should be considered...

Malicious code in consgraphqlnodeserv (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1884eb1cec539175697a599d5efe57c8627b48df2ec8f1e92eff097a796510da Any computer that has this package installed or running should be considered...

Malicious code in super-alpha-api (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5739 Malicious code in with-shadcn (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01233cb16b11624de4b6a0eb8110923a4611ba7c757ee2a9bdb46370b77099d6 Any computer that has this package installed or running should be considered...

Malicious code in on-off-ramp-demo (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b6976f60e83349939cda55fa116d6f3df6d085aea3969653b767ba47863deff Any computer that has this package installed or running should be considered...

Malicious code in onramp-demo-mobile (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 126a99667f6fc4e7bf8fe4a326ada712703d5aaef88ea752eefb365a6157b1a9 Any computer that has this package installed or running should be considered...

Malicious code in mre-layout-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca72674752dda2346e914163e1a4ce3dd2a83b813747ebf2e4330596b0afb2c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5616 Malicious code in with-next-intl (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d19de7a1f0382187b4331c426d9c88dddd8734112cac8bfd611c4edadf922ad Any computer that has this package installed or running should be considered...

MAL-2025-5656 Malicious code in malinssx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec1d3e0940a3c37917b528689547d3728f9f3d0b9e408acc7dcc67435c09d2b0 The only goal of the package is to execute a webhook or a suspicious file during installation. Closely related to 2025-07-0x9xnx - created after previous...

Malicious code in title-dependencies (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5591 Malicious code in show-dependencies (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ffc4fb420d4b6a7508fa65da3a3695af74f01732f92bf8a4beaac80d16c1985 The OpenSSF Package Analysis project identified 'show-dependencies' @...

Malicious code in k6-studio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b163d493761fa12ed8094157415651ec1b22824f021a7483637346825e08cca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @frontend-clients/core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09d9aaa390d29f17fb6be0a0f730c5806ca1179876940237e6319d1378d0fbd3 Any computer that has this package installed or running should be considered...