Malicious Package

Overview rubbydev-crash-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview wailib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @bluewin/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview prastzy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview luoxy-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ai-workshop-maa15-radio is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview alexa-cybertron-team-code-review-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview gocommunity.io/orderedbtree is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview gogets.dev/btreex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in kartykgithub-ph-f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e9463feb27a295ad0b7136837e12908bc8d668e0b7bbd70309c760165f071f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17425 Malicious code in kartykgithub-ph-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83e406902c3f8a5a3951ce0c776e78b867e679199c683b67d6f2df8059dcdf72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykgithub-ph-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83e406902c3f8a5a3951ce0c776e78b867e679199c683b67d6f2df8059dcdf72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17424 Malicious code in kartykgithub-ph-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1a43aa1b797b98f578426b682f248b9e54bfd67acf5fc4030455c7d7228bc92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykgithub-ph-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1a43aa1b797b98f578426b682f248b9e54bfd67acf5fc4030455c7d7228bc92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17440 Malicious code in @erlanzz/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17451 Malicious code in wailib (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17423 Malicious code in illusion-datalab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6004785b370b58ab360f70d7959fad47ec55ec609e8556217976fc405a610b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17421 Malicious code in spo365-graph (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b SPO365-GRAPH presents itself as a SharePoint Online Graph client, but the shipped library module SPO365GRAPH/SPO365GRAPH.py consists entirely of stub...

Malicious code in spo365-graph (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b SPO365-GRAPH presents itself as a SharePoint Online Graph client, but the shipped library module SPO365GRAPH/SPO365GRAPH.py consists entirely of stub...

MAL-2026-17362 Malicious code in @kelvdra/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...