MAL-2026-16411 Malicious code in no-fun (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The payload does not run at install time, but upon invocation of the package. A language-specific loader then...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...

MAL-2026-16410 Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...

Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...

MAL-2026-16409 Malicious code in ubiquiti-agents-link-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4 The package's bin entry index.js runs execSync'id' and collects os.userInfo.username and os.hostname, then HTTPS-POSTs the JSON payload to the...

Malicious code in ubiquiti-agents-link-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4 The package's bin entry index.js runs execSync'id' and collects os.userInfo.username and os.hostname, then HTTPS-POSTs the JSON payload to the...

Malicious code in snap-queue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bb29642def9150e89bacf4da4e1a64f7bc972cd145053cbb0feee0baa768f3 The sdist's setup.py defines a wusboot function that is invoked at module top-level before setup..., so it runs automatically on pip install...

MAL-2026-16408 Malicious code in snap-queue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bb29642def9150e89bacf4da4e1a64f7bc972cd145053cbb0feee0baa768f3 The sdist's setup.py defines a wusboot function that is invoked at module top-level before setup..., so it runs automatically on pip install...

Malicious code in poly-check-b (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...

MAL-2026-16407 Malicious code in poly-check-b (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...

MAL-2026-16406 Malicious code in crypto-trader-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e855a3ce62e35b613e702e710b81900769c241707c80f6a61462df0927529c The package presents itself as a crypto trading and backtesting toolkit, but ships no library code matching that description — SOURCES.txt lists only...

Malicious code in crypto-trader-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e855a3ce62e35b613e702e710b81900769c241707c80f6a61462df0927529c The package presents itself as a crypto trading and backtesting toolkit, but ships no library code matching that description — SOURCES.txt lists only...

Malicious code in tailwind-form-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 353df78be0134825a2efc6d7e4d4cbf25dfba4d057925e64fc117e78a3f2814a The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is heavily obfuscated obfuscator.io-style rotated string...

MAL-2026-16405 Malicious code in tailwind-form-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 353df78be0134825a2efc6d7e4d4cbf25dfba4d057925e64fc117e78a3f2814a The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is heavily obfuscated obfuscator.io-style rotated string...

Malicious code in envforge3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3770550d6db043006c8b2aa75dcac951db1cd9eb7494b0259d7eb69d28f26e32 On require of the package's main entry, dist/index.cjs invokes dispatchAnalytics at module top level. That routine reads dist/stest.jpg, extracts byt...

Malicious code in envparse2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59aed7381a2a7026336f5e79671e05e9313688533ca35e15cf7010a975c2c897 On require of the package's main entry and on invocation of the dot2env CLI, the module reads the bundled dist/stest.jpg, parses JPEG markers, and...

Malicious code in node-env-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0011ed2fd25fdc35a89f50c2eb1d7d895210908c637be0fcaca077d032baaee6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16394 Malicious code in envparse2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59aed7381a2a7026336f5e79671e05e9313688533ca35e15cf7010a975c2c897 On require of the package's main entry and on invocation of the dot2env CLI, the module reads the bundled dist/stest.jpg, parses JPEG markers, and...

MAL-2026-16403 Malicious code in node-env-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0011ed2fd25fdc35a89f50c2eb1d7d895210908c637be0fcaca077d032baaee6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...