Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

tamilai (0.0.2) potentially affected by CVE-2026-61426 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-61426 Source advisory: SNYK:JS-PRAISONAI-17950764...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.2) potentially affected by CVE-2026-61448 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.2 Source cves: CVE-2026-61448 Source advisory: SNYK:JS-PARSESERVER-17950968...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs24: nodejs24-24.18.0-0.3.hum1 aarch64, x8664 nodejs24-bin-24.18.0-0.3.hum1 noarch nodejs24-devel-24.18.0-0.3.hum1 aarch64, x8664 nodejs24-docs-24.18.0-0.3.hum1 noarch...

Malicious code in authvaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c707d53e30a333f8b8cf03ac2480eee3e2fa9c3c3164b1a100d333c91f9f3a On require of authvaultx main: auth.js, which loads lib/writer.js, top-level code attempts to load the separately published npm package...

Malicious code in polymarket-mcp-v2 (npm)

polymarket-mcp-v2 is an information stealer and remote-access backdoor that runs automatically on npm install. It steals Solana keypairs, .env secrets and other credential files, and installs an attacker-controlled SSH key into /.ssh/authorizedkeys, then opens port 22 for persistent access. Any...

MAL-2026-10179 Malicious code in @uwr/colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91240d8fb55b7ed4730a41f3a334c633bf1a03afb649fd473cad0c0a25312847 The package's postinstall script reads the installer's machine hostname via os.hostname and performs a DNS lookup of...

Malicious code in fkext-browser-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects...

MAL-2026-10181 Malicious code in consumerweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance os.hostname, os.userInfo.usernam...

MAL-2026-10176 Malicious code in uncaxss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acda9720ae54881219c0fbcee73795be85877d292aa62662f7cb6b92e775f608 Package ships an obfuscated dist/index.js that is invoked from the postinstall lifecycle hook node dist/index.js. At install time, the script perform...

@injectivelabs/wallet-base (1.20.21), @injectivelabs/wallet-core (1.20.21) +9 more potentially affected by unknown CVE via @injectivelabs/sdk-ts (1.20.21)

@injectivelabs/sdk-ts NPM version 1.20.21 is affected by a known vulnerability. The following packages have a transitive dependency on @injectivelabs/sdk-ts and may be impacted: - @injectivelabs/wallet-base 1.20.21 - @injectivelabs/wallet-core 1.20.21 - @injectivelabs/wallet-cosmos 1.20.21 -...

MAL-2026-10170 Malicious code in paysafe-kyc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 626046f7b80cd91ce41e057b4bdab7b5bbb30b7fbceb0284894287cfd441c624 The package presents itself as the Paysafe KYC identity verification SDK but does not call any Paysafe API. PaysafeClient's payments/customers method...

1password-node (>=3.0.0-rc.0, <=3.0.0), 2020-react (>=1.2.2, <=1.2.6) +9782 more potentially affected by CVE-2026-39244 via adm-zip (>=0.1.4, <=0.5.17)

adm-zip NPM version =0.1.4, =3.0.0-rc.0, =1.2.2, =1.0.0, =1.0.0, =3.4.0, =1.17.6-next.0, =0.0.89, =1.0.9, =0.0.1, =0.0.1, =0.1.2-alpha.0, =0.2.0, =0.1.0, =1.0.1, =1.0.2 and more Source cves: CVE-2026-39244 Source advisory: SNYK:JS-ADMZIP-17954277...

MAL-2026-10156 Malicious code in notify-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fec337f1c1858ad605f875ea51feb09f84fbd2eb702c7bc0462dbb427b3eff05 [email protected] presents itself as the pino logger export name pino, README and type definitions mimic pino, npm version badge points at the...

MAL-2026-10155 Malicious code in notify-funcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b65341bde476af6b80e1fbaa9f9a844b7fdc023ef02f5fabb88514d88012159 The package presents itself as a pino-compatible logging middleware exports check as both default and pino named export but its actual behavior on...

MAL-2026-10159 Malicious code in npm-rce-safe-proof-yourname (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9fdedc15d959d978bd3563d29d16c5ab226d3c4fa4ab8b6fecf8bdf130e29ab On npm install, postinstall.js runs whoami, reads os.hostname, process.platform, and process.version, and transmits them via HTTPS GET to a hardcoded...

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/[email protected] , came embedded wi...

MAL-2026-10144 Malicious code in mdb-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24ffe7ac6e64aab50d9ba84f5b06ffd1047663698d25071770749b36afe6543 The package's default export getPlugin performs an HTTPS fetch to https://svganchordev.net/icons/107 with URL components split across protocol, domai...

Malicious code in mdb-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24ffe7ac6e64aab50d9ba84f5b06ffd1047663698d25071770749b36afe6543 The package's default export getPlugin performs an HTTPS fetch to https://svganchordev.net/icons/107 with URL components split across protocol, domai...

MAL-2026-10149 Malicious code in polymarket-gamma-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d686b83e6a563376e3609a63752840d3423e8a71e9261dffa87ae81b822e7f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...