MAL-2026-17787 Malicious code in evm-tx-decoder (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e478aa0270779720106fc6169e89fde089af352214fc720fbf8c284d51415f59 The gem's native-extension build script ext/extconf.rb decodes a base64-embedded Ruby payload and executes it via eval inside a double-forked, detach...

MAL-2026-17758 Malicious code in react-dropzone-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of...

Malicious code in react-dropzone-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28267e7286151b52836170e94617afcb3c49d17424f7b7ea9fab480c6e008c7c The package's package.json declares a preinstall lifecycle script that runs automatically on npm install. The script performs an nslookup of...

MAL-2026-17789 Malicious code in hd-wallet-generator (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6925082b6aa5db29d0569324b4485976add2368c78635d4be5c52270ee3771 The gem's declared native extension build script ext/hdwalletgenerator/extconf.rb executes a Base64-encoded payload via eval during gem install. The...

MAL-2026-17797 Malicious code in ton-jetton-tools (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e70156c49000f2a02130da13465705bea1e9663b3ba57246a4e264bb12db25 The gem's native-extension build script extconf.rb contains a base64-encoded Ruby payload that is decoded and executed via eval during gem install. T...

MAL-2026-17802 Malicious code in xrp-ledger-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a...

MAL-2026-17788 Malicious code in gas-refuel-bridge (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd99ebd0f028669dafee3405a3ac4ebb9e264b7d9bfce963e68b259dfe88a3 The gem's native extension build script extconf.rb base64-decodes an embedded Ruby payload and eval's it during gem install. The payload double-forks...

Malicious code in sol-mint-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2940bc600ade9f91afdc44ccc04cdab589d276b0504b3f12ffb4a4e827920bd9 The gem ships a native-extension stub extconf.rb that gem install executes automatically, but no C/C++ sources accompany it and lib/solmintutils.rb i...

Malicious code in agent-vx (PyPI)

Source: kam193 815c9aad02259785c1e8b8569c0aead4598c1ea8f4802463a8db7f7240410296 The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-17756 Malicious code in pafer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a74b7c5b356a87fe0262954cbedbcc432497ab25edaccbade0ce9ce04b16a8c9 In this campaign, the main package webreader has an embeded pickle disguised as a config. A related dependency pafer contains code to load the pickle. During...

MAL-2026-17754 Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

MAL-2026-17864 Malicious code in passwordcracker (npm)

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

Malicious code in test-account-portal-fe (npm)

Source: ossf-package-analysis 5dd02103458df4faa2c37da43a76a468a0a22d591fb77c5d756e7d7496d68907 The OpenSSF Package Analysis project identified 'test-account-portal-fe' @ 100.100.102 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in kmf-i18n (npm)

Source: ossf-package-analysis c506e33bdce28606141b7d2bbebbae50e97e466ab04664a9cca8fa48a3622ae1 The OpenSSF Package Analysis project identified 'kmf-i18n' @ 100.100.102 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in @myorder-frontend-commons/analytics (npm)

Source: ossf-package-analysis 43a2fe0052005fedc0434fc354ae8777e198113f2371fddfbc9d79ffdd87fbb5 The OpenSSF Package Analysis project identified '@myorder-frontend-commons/analytics' @ 99.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated...

Malicious code in kmf-bootstrap (npm)

Source: ossf-package-analysis 4a4e085f9bdddf6800e613b7cdfeb6b2481b2fe9bf0ccb2a5b1bffad9538194b The OpenSSF Package Analysis project identified 'kmf-bootstrap' @ 100.100.102 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

MAL-2026-17750 Malicious code in @fer2809fl/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 333123c7c0137131633b11cc8a16d12db3c3755f41965453297ff01e2dcc44c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17751 Malicious code in cloud-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ee1c98d68a84e021c6be18dac81c672b3d0f36fcdde105992c46beab9d8d7bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview agent-vx is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...