MAL-2026-17859 Malicious code in opencode2-windows-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 263b5345eacdaa0cb508c1d73db3da28902fd6e018ce8c01dc99ebc6babb9f97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17858 Malicious code in opencode2-linux-x64-musl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5865a6de931f6eeceeaa7735203a1da71c5d55a10a580273fc8111210a14eaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17851 Malicious code in yoodan-github-single-ver-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5ec21b694320e65a8b1f38838f14f00ed00b3b1e4f6a5d6aeef960f900d1d55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17850 Malicious code in @chatest/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe80b7b76923a24948c1d095c3dc2474c0aac3574a3cf2046bf152c7dcde0aac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17849 Malicious code in brass-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657abbbfdd17b21af7ad85e8634e0fb2ac36e35c6b95996322f10584ef4c1570 [email protected] declares its only dependency ltidisafe as a direct HTTPS tarball URL...

PT-2026-112875

Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 2.1.179 Description The plugin installation flow for Claude Code and Claude Desktop executes a git checkout for a marketplace-pinned commit but fails to verify if the resulting HEAD matches the pinned 40-character...

MAL-2026-17847 Malicious code in npp-ml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool. --- Category: MALICIOUS - The...

CVE-2026-96012

The IBM Db2 Mirror for i GUI (versions 7.4, 7.5, and 7.6 ) is vulnerable to a critical privilege escalation issue (CWE-264 ). An authenticated attacker can craft a malicious request that bypasses input validation and authorization checks to execute arbitrary code, potentially gaining elevated sys...

EUVD-2026-97815

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated...

MAL-2026-17443 Malicious code in @zanta/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17846 Malicious code in @yudzxml/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96357918fec8e046fe049ec94c614ab988e412532ace70beeb64d737533c3a30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17843 Malicious code in @xrelly-stack/bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50a8bf97baef2afe279a36ada416d0c235247d68c31748c360ca9bf863cdbe49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17845 Malicious code in node-telegram-sockets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaa0928c7e6cf97f1059c7c8ec8ea2c1ffe53c127480bfe8f5081b489676d26d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17841 Malicious code in @wanzxlonelyy/bailslonely (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05fbc39cd82cca7d65bc1220f85315d4ad6584a5f28a9ddb0e38744dbbd9c644 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17840 Malicious code in @wanzlonelyy/bailslonely (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b1103787a1c723a0e4102acd15834c5420336480aec1e6dc37ba741937f735a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17839 Malicious code in @wanzlonely/bailsme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f3eccacfdf2ece39dce55b7c1ba8330f39be88659053a43713fb16e39b6e2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17838 Malicious code in @wanzlonely/bailsforme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1d20a942a9977d81d31c2c6e2107befe05ef40ea0f60363afb3132b03eb29d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17844 Malicious code in bailslonely (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a36c9cf3f28683672c6c3bc2ba38d881dec1c6bd97e72e2bf13e29ee76604389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17382 Malicious code in @wenzyx1/bails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17379 Malicious code in @sakataoffc/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...