MAL-2026-15323 Malicious code in secure-test-browser-cnsorczp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2180c388e6ab2eb5969da899487cf674164ef73ffbcbdc929bda7e440c378510 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15373 Malicious code in secure-test-browser-k866lkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 234f1df9c5e682a0e08e99dc5fdcec6bf89a911051031d5ccda5472fcb721d01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15284 Malicious code in secure-test-browser-4eirlssh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f5f70ba8dcc1b2a777d5133b3b0b7f4bcf7be0116c7290484f405235a432da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-21qgniz4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6500ad1ff35a18b4a6d59261ab7e33c5035b0313f4da57525f75b0f70b335762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-iy9s690g (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 010558997df83377c0b79a52913561470b9d21cce9659a3b30c3f7e7f076b6d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15436 Malicious code in secure-test-browser-ui1d892v (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44bcf3be56af9ecd21fab7aae6b84be4ce66de8fc32609b1f4bb924ba39163ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15116 Malicious code in classlink-mwnbufxp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7b68b3ba66b8fe9bed99c395a676db7d0107c7b0330d8d00edbf52b6fffb08f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-y4yd7ndu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f792c1beb7268d7c12da9151f5f9596965848efd31f960cf9e5d9025a97fd8a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-xynt39lg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a734e3f6caa0722bcb17cfd44319516cc5cbc36c0581c4600e9c694bece70ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-0xcszcdo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 368ae41ef0802d6521cdf120ef4a0b8acf46421306597b5aab3ec107f289a741 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fleetbo/svro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d86373813cd4d2b65edb11f6a3f352ad81a55e7de0444884f66b0adb482e661 The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled identifiers 0x56260b, 0x12d64...

PT-2026-83302

HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. Attackers can delete team members including owners, rotate API keys, and rename teams by sending requests to PATCH /team/apiKey, PATCH...

Malicious code in @hd-team/app-dnpkg-ten (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39fc060cffde63f6797eaa1eb715dbfec4a108f1c8d4b54d6ed6b63072bd9d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in inspectstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17cc87250d7ea2211f538d56ca04d81a6653e6493beb475ea371873ddfe6a65e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14561 Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

MAL-2026-14559 Malicious code in imo-allowlist-xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f429a987c3b4800204131b27faae0c29e55a0761a1fa2a0306ab14a343afd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14544 Malicious code in self-sign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b684f78f17626dead6b3d11131179a7a1aff7fa5e903daeecdac17ce8e3b99b3 The exported generate function in [email protected] accepts an undocumented third defaults parameter. When passed a string, the code strips PEM...

Malicious code in svelte-vli-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e69d1c24676b4273c3413856b424256c6ff7a437a48e7037156fa5f7f8911060 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in fivem-tool-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11831d8204f695d6cfc23750c0899851f375e519e715e845730f90b7fc8d51a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14503 Malicious code in text-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163de9a9fb651da86f266476767aea6f3b53b316ad3a3b269d469e6447fe43bd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...