MAL-2026-17193 Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...

MAL-2026-17191 Malicious code in requests-cache-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1655ea47fc7ccd39294203776ee3dcb01a394c40d93e05b7b527700b19de42c8 During installation and importing the module, the code downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in requests-cache-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1655ea47fc7ccd39294203776ee3dcb01a394c40d93e05b7b527700b19de42c8 During installation and importing the module, the code downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in chai-as-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line 4.4MB obfuscator.io-packed IIFE hex-escaped...

MAL-2026-17189 Malicious code in chai-as-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line 4.4MB obfuscator.io-packed IIFE hex-escaped...

MAL-2026-17190 Malicious code in cma-self-hosted-sandbox-cf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d91a7568b717361d5b3727d46e8bf567fc038f95c5fa22c5222a272460bb9f35 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the machine's hostname, current user info, home director...

Malicious Package

Overview my-private-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview reqparser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview tego-managed-agents-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview building-build is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview analytics-widget is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @alphaspace/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-offline-token-verifier-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious code in @digift/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 103ec4b63e45d1bc9b3e3c2e616eedfa134f9f8bdcb6480f33fbbaa280038803 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17187 Malicious code in @digift/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 103ec4b63e45d1bc9b3e3c2e616eedfa134f9f8bdcb6480f33fbbaa280038803 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17186 Malicious code in @nubjs/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b292cfe4598353bc8491677099fd2c056f4136eb686345bbdbe68fa887e368c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...

MAL-2026-17184 Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...

Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...

MAL-2026-17183 Malicious code in tego-managed-agents-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c8a01de8d706d83a4b80b845099c11602ba778a392337cad2d9a8a40090b5d The package's custom install command serializes the entire process environment dictos.environ to JSON and POSTs it to the hardcoded endpoint...