Malicious Package

Overview animatecss-tailwind-adapter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview hardhat-bits is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview clickfixnpmdelivery is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @galicia-toolkit/error-master is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview tailwindcss-ui-extensions is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview node-fetch-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview connector-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17342 Malicious code in @bellaxchuu/belbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17396 Malicious code in kiyoramarkets (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in mfasolver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...

MAL-2026-17662 Malicious code in hardhat-promised (npm)

[email protected] was published to npm on 2026-10-06 13:59 UTC by user ryan.danial915 account's only package, created the same day. The name targets the Ethereum development tool hardhat. The package is a verbatim copy of the pino logger README, docs, lib/.js, SECURITY.md; the README badges...

MAL-2026-17661 Malicious code in hardhat-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02 The package is published as hardhat-pack, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript...

Malicious code in hardhat-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02 The package is published as hardhat-pack, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript...

MAL-2026-17654 Malicious code in abbishal-poc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...

MAL-2026-17658 Malicious code in hardhat-bits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e10f22980d33eea7649312f6b2b0a94637e5b4da400f7d585c58b6902a77944 The package is published as hardhat-bits but its README, LICENSE, docs/, and lib/ files are copied verbatim from the pino logger project, providing...

MAL-2026-17660 Malicious code in hardhat-option (npm)

[email protected] was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like [email protected] published the day before, the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger README badges still point to pi...

Malicious code in hardhat-option (npm)

[email protected] was published to npm on 2026-10-07 09:12 UTC and removed by npm on 2026-10-07 15:29 UTC. Like [email protected] published the day before, the name targets the Ethereum development tool hardhat, and the package is a copy of the pino logger README badges still point to pi...

Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

MAL-2026-17657 Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....