MAL-2026-17686 Malicious code in tailwindcss-effects-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12c9b58efdc05227da51bfb1031a80205144b4c6945b06eb9cbad7d416ab4873 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17687 Malicious code in tailwindcss-ui-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deb799e18fe77928819080979322bbcc868ba4373af021aec1efea4b201e4108 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

MAL-2026-17684 Malicious code in node-gyp-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcec19492c8bdcd8c866d1aad1a2b8a253d7d9bbc8184ff182af71a75ce56589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17683 Malicious code in node-fetch-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17677 Malicious code in @bellaxchuu/overbugs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4bf34e6d2aa5b187e4dba9c90ce9515cd1fdc5a43f37195ba21e9cb418eb19c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17676 Malicious code in @bellaxchuu/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f70788aeca5b98fbe0c721d7f6a88c036d661c3f0132443a6bdb97080f5819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17350 Malicious code in @bellaxchuu/xtrxbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17346 Malicious code in @bellaxchuu/privatebails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17678 Malicious code in @bellaxchuu/xbailey (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d07ffaff1ea6694d0579feba4090d61917939563b17e9395b875bb0c2aaf0b01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17345 Malicious code in @bellaxchuu/flowblue (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17679 Malicious code in @bellaxchuu/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f73138335788b7e9bb6c1df9db9ae6f82fa260c75d703ddfb850cba883c7d076 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17680 Malicious code in @bellaxchuu/yarnbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f991cf1a14df0cd0bbec0bd9340f983ea34dc98070e0e1c810e22653aecf469 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17675 Malicious code in @bellaxchuu/bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6ca3e47d499dc50a641bc4c0d6c01228aa55dfcf76a4c8504680ce1dc1196e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17400 Malicious code in my-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17674 Malicious code in brat-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53137fe02a825bde6d844ec337cba590b1c454e97e52c2792358555eea1dd76b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17672 Malicious code in @xayz/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a9744aa6c5f3c994e66b4847aba63d6cf1503583f0a23185c67bb32b7394e77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17673 Malicious code in bottino-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f855c5c354d7a875b2e0c853f4fcfda7fb1033d5a89b21c4bdd3250412be984 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17670 Malicious code in @itsmee_aizat.id/baileys2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c95f98902ced2f03261621ba4cb5386a892bf31ac4510b916708d3d3eb21aa50 package.json declares "libsignal": "github:tenka-san/libsignal-node" as a runtime dependency. The source is a GitHub user account unrelated to the...

MAL-2026-17385 Malicious code in albert-anitabaileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...