MSC-2026-12947

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malware dropper – this package contains a Trojan...

MSC-2026-12927

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malware dropper – this package contains a Trojan...

MSC-2026-12932

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malware dropper – this package contains a Trojan...

MSC-2026-12934

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malware dropper – this package contains a Trojan...

MSC-2026-12926

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malware dropper – this package contains a Trojan...

MSC-2026-12931

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malware dropper – this package contains a Trojan...

MSC-2026-12933

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Malware dropper – this package contains a Trojan...

MSC-2026-12946

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12929

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-12938

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Malicious code in airdrop-eligibility-check (RubyGems)

Source: amazon-inspector eb3461788cd7b809ba613c07b39b583fb968ce927ccfc15433673e2731ca68d8 The gem's extconf.rb, executed during gem install, decodes a base64 Ruby payload and eval's it inside a detached double-forked Process.setsid child process after a randomized 20–40 minute sleep. The payload...

MAL-2026-17801 Malicious code in web3-signer-kit (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe57c8011ef7048ef33ccdb828615b8efd9ab10799a2a730d12c2d854c2e0895 The gem's extconf.rb decodes a base64 literal and eval's it at gem install time inside a double-forked, session-detached child whose stdio is...

MAL-2026-17779 Malicious code in airdrop-eligibility-check (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb3461788cd7b809ba613c07b39b583fb968ce927ccfc15433673e2731ca68d8 The gem's extconf.rb, executed during gem install, decodes a base64 Ruby payload and eval's it inside a detached double-forked Process.setsid child...

Malicious code in hd-wallet-generator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6925082b6aa5db29d0569324b4485976add2368c78635d4be5c52270ee3771 The gem's declared native extension build script ext/hdwalletgenerator/extconf.rb executes a Base64-encoded payload via eval during gem install. The...

Malicious code in perp-funding-rates (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 123418539e0264e9d58c8b51976723aff3eceec10520c231d7bc847edd51d691 The gem's native-extension script ext/perpfundingrates/extconf.rb contains no real build logic: it declares createmakefile'bitcoinrpclitenative' but...

MAL-2026-17802 Malicious code in xrp-ledger-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a...

Malicious code in hardhat-option (npm)

Source: amazon-inspector 2d460f6c739361d793fbc66b2aa32d1d9ab6fe0df4caefe13c590f40d05d5277 The package's declared main index.js immediately requires./lib/config, which is a single-line 4.5MB obfuscator.io-style bundle 26,234-entry hex-escaped string array, rotated decoder wrappers, control-flow...

Malicious code in hardhat-option (npm)

[email protected] was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like [email protected] published the day before, the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger README badges still point to pi...

MAL-2026-17660 Malicious code in hardhat-option (npm)

[email protected] was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like [email protected] published the day before, the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger README badges still point to pi...

Malicious code in bip39-wordlist-utils (RubyGems)

RubyGems runs this gem's native extension script ext/bip39-wordlist-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over ...