MAL-2026-12083 Malicious code in crypto-wallet-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0bf047680c46c2f4c37c8a7b77e9d993acb05ef4925c660e0c5cccf95be581f During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in crypto-wallet-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0bf047680c46c2f4c37c8a7b77e9d993acb05ef4925c660e0c5cccf95be581f During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in crypto-trading-toolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20c37efbefbfb1922a205d954cdb5666103fd3e343a67e89dc19694ad5b64ef0 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12081 Malicious code in bitcoinlib-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 32582a69a108bf3ab34d8bd16122918dd29a56bff6f68a771b77c6c946bf9308 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-12080 Malicious code in bip39-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c188f84ee0ad8238ed89a94673968e9f17c44d91d25dfe8012efd39e01705081 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

Malicious code in @zzzgenesis00/mnemonic-to-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3af286f89deaee9dcce3d85f9bd53bc2b03e63dccf0073c74988b3f3a3763e8 On npm install, postinstall.js executes and enumerates installer-side secrets: files under /.ssh non-.pub private keys, /.npmrc, /.gitconfig,...

MAL-2026-12079 Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

Malicious code in @zzzgenesis00/docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2417f0620e130c16865914c5f79fdff63bdda0daf3257955c8fd536ab894c1b1 postinstall.js runs automatically on npm install and enumerates installer-side secret stores including /.ssh, /.npmrc, /.gitconfig, Chrome and Firefo...

MAL-2026-12073 Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

Malicious code in @zzzgenesis00/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28a7a4b265a274814769439b7bcc3e03e573308ac72036558815feabfec0c8af The package @zzzgenesis00/playwrite is a typosquat of playwright. Its exported launch returns empty stub methods, while postinstall.js also loaded...

MAL-2026-12057 Malicious code in @zzzgenesis00/playwrite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28a7a4b265a274814769439b7bcc3e03e573308ac72036558815feabfec0c8af The package @zzzgenesis00/playwrite is a typosquat of playwright. Its exported launch returns empty stub methods, while postinstall.js also loaded...

MAL-2026-12069 Malicious code in nxify-unic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...

MAL-2026-12058 Malicious code in @zzzgenesis00/spl-token-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ad6fd0f8ef16ee23b458b541d9cdfc73147e768ec9f8676ed50b30996231813 postinstall.js runs unconditionally on npm install and harvests installer-side secrets before transmitting them off-host. Collected data includes hos...

Malicious code in data-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to...

Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

MAL-2026-12031 Malicious code in @zzzgenesis00/ethers-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a206d278a371fdbb349d679797e7835b5e0ba40d1ac186b3287beb0a23540f09 The package's postinstall.js runs automatically on npm install and harvests installer-owned secrets: it scrapes a curated env-var allowlist NPMTOKEN,...

MAL-2026-12030 Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

Linux Distros Unpatched Vulnerability : CVE-2026-71235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua scri...