Malicious code in tachyon-spade-reporter (npm)

The package exfiltrates system data to remote server --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80ad134ce018cc5d3d53f7bcb89de68046aacd2438d13bd6fb93875be5380223 The package tachyon-spade-reporter was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1387 Malicious code in tahoe-tap (npm)

Malicious package detected. Executes code during installation via preinstall script in package.json and has only one version published. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deec4b3e879632ae9819b52e88ae689725b1af688aecd541e498d2bac084f848 The package...

Malicious code in twitch-twilight-intl (npm)

The package exfiltrates system data to remote server --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01efff3eeb27457695f8dc2651f9944b72ee21d46a4579f33d0078e509887101 The package twitch-twilight-intl was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1384 Malicious code in @lux2/ssr-catalogue-sfcc (npm)

Package collects system info, exfiltrates data to a suspicious IP, executes shell commands, and uses pre/postinstall scripts. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b625e0932d70166d526fb8fa4993c8c448699203e795ad308cfe52cd784b28ff The package...

MAL-2026-1379 Malicious code in 8x8-developer-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 830ce990639483b2f7a9ea4e000d63c831e0d58c94e718a1a20add6885cb93ef The package 8x8-developer-docs was found to contain malicious code. Source: ghsa-malware...

Malicious code in f0-service-address-doctor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb126414f1575e7289915e4edd746dbac3d039a0a433f5069309acc281e7892 The package f0-service-address-doctor was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1377 Malicious code in adroit-websdk-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2635788b71e7d2d9a220ca0717bb46d6704bb205393b2f479105c20d9f94735e The package adroit-websdk-server was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in cline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d7531f4d4af07fee607e1d2985d0ea5b41dbf28cca5bc16c8457934e372f86 The package cline was found to contain malicious code. Source: google-open-source-security...

Malicious Package

Overview styled-components-a11y is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior T...

Malicious Package

Overview syntax-async-generators is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior...

Malicious Package

Overview proposal-typescript is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...

Malicious Package

Overview require-in-package is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...

Malicious code in @adamallana0909/apple-research-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d8bddd202efdf484dda4f9ff697fb7eab0e1227f76c736d92e6af21a85b89fe The package @adamallana0909/apple-research-test was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-1376 Malicious code in @appleseed-apple/ac-sasskit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88124096765095b75d53f5129410a02db9d3966422e222d21b811aa0699ea725 The package @appleseed-apple/ac-sasskit was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-1368 Malicious code in json-specparse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28ad383c55884ea3f12626f13a56f36b7fbc1eab649de47cfcb657478162850c The package json-specparse was found to contain malicious code. Source: ghsa-malware 18627c1c0def6faaa8722de5bc97f27981110eaf8844500039b842de043d2f62...

Malicious Package

Overview mezukabil is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in @kinggupong/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c19c128fca5c3aacdbc42a4005ff6e5fac66da9fb811bf98788503f6dfd00eb The package @kinggupong/libsignal-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1367 Malicious code in @kinggupong/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c19c128fca5c3aacdbc42a4005ff6e5fac66da9fb811bf98788503f6dfd00eb The package @kinggupong/libsignal-node was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview @kinggupong/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview unibody is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...