MAL-2026-17738 Malicious code in asepxyzxrazamodsnew-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ead2c2294eec38c18f277f87b0fe28dad253a234ad0b64d6a2ea5047a485031e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17734 Malicious code in asepxyz-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9e873795c4634852530066ca11f554da84043934f246df7b3edbe868ea343ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ig-gox (PyPI)

Importing iggox runs iggox/init.py, which decodes a blob base64, XOR, zlib after a few anti-debugging checks and execs it as main. The decoded loader only goes on if it looks like a physical Android device running Termux it turns away x86, emulators and VMs, installs requests and cryptography if...

MAL-2026-17712 Malicious code in ig-gox (PyPI)

Importing iggox runs iggox/init.py, which decodes a blob base64, XOR, zlib after a few anti-debugging checks and execs it as main. The decoded loader only goes on if it looks like a physical Android device running Termux it turns away x86, emulators and VMs, installs requests and cryptography if...

Malicious code in @galicia-toolkit-nestjs/swagger (npm)

@galicia-toolkit-nestjs/swagger is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in @galicia-toolkit-nestjs/commons (npm)

@galicia-toolkit-nestjs/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in @galicia-toolkit-nestjs/paas (npm)

@galicia-toolkit-nestjs/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim...

MAL-2026-17729 Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm)

@galicia-toolkit-nestjs-20-lite/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon...

MAL-2026-17724 Malicious code in @galicia-toolkit-nestjs/swagger (npm)

@galicia-toolkit-nestjs/swagger is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

PT-2026-108966

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9 Description The self-upgrade mechanism validates downloaded binaries using a same-origin digest obtained from the same upgrade mirror. A compromised mirror or a network attacker capable of altering both...

MAL-2026-17720 Malicious code in @galicia-toolkit-cheques-nc/front (npm)

@galicia-toolkit-cheques-nc/front is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

MAL-2026-17722 Malicious code in @galicia-toolkit-nestjs/commons (npm)

@galicia-toolkit-nestjs/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

MAL-2026-17727 Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

@galicia-toolkit-nestjs-20/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

MAL-2026-17723 Malicious code in @galicia-toolkit-nestjs/paas (npm)

@galicia-toolkit-nestjs/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim...

MAL-2026-17709 Malicious code in revine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dbf4288af8869a7f4875c4de38fa05874802fc4f0fda831170aa143bc1dbb9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17702 Malicious code in kafka-helmsman (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...

MAL-2026-17701 Malicious code in @kxafunc/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629c665fbfef767c56d24af935d38312f7aa88d1c71d9dfb8c427192e54add0b package.json aliases the libsignal dependency to npm:@bellaxchuu/libsignal-node@latest — a non-standard publisher pinned to the mutable latest dist-t...

MAL-2026-17693 Malicious code in @bitwardne/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7d0b3168a3a56cb6208688970e6109a964ccfb99a97fe7061d57e007b67ca6 package.json declares a preinstall lifecycle script of the form 'curl -L | node', which fetches remote content and executes it in Node at npm install...

MAL-2026-17692 Malicious code in clickfix_npm_delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d The package has no library surface. package.json declares main: index.html and the tarball ships only that HTML page, whose sole purpose is a ClickFi...

Malicious code in clickfix_npm_delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d The package has no library surface. package.json declares main: index.html and the tarball ships only that HTML page, whose sole purpose is a ClickFi...