Malicious code in 3layerdipstackrcuf3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f32fc4b5be00ab27d18166f1514a8f15761114c074e5d674aab11e8418fe715 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstackb1ojqr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e3dab1d35db1fead77b008564cc0a8f955c3707b64ecb95a32e9996dc792dca The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstacknqxij (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b17910b852ee2ef91ab8054c257befcc2c22e592fdbbada49e7a1a120ff5e61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-775iocrc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bf11c5ac6ebf9649bfcb74791eab52d759a9a95a7e58e885fc259838f912501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15151 Malicious code in classlink-u2n0gqft (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ee03e7512c44f753499e4c65ee09c2b840f99b2c6832eb62d12cdf651eca3d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-5tdruito (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1aaacecc0eec68dbb1e2d4d0954ae70e0132440a33a9d530634e77f95ec02b2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-a510xpj1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed80bb819be9854d6b22f49ad1bb8d88077900e5c5cf78b05990b9623221bf7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-uwydfkra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27aa86f8da7b4874fce31dd729ea9f452e0f892cd470124c903c73ccf0e3de07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15380 Malicious code in secure-test-browser-l78cgbss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9446321e98d28676832ac1298911b488bbdf2a15381d487cc0fcd2bae7422fd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bnotify-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0861227aa2c7246f74708656f530b7f99a71f6e6e0be93a1ea7dc3b2d6c814d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14549 Malicious code in the_tax_free_cashier_is_at_9f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0596e225c3ec8b9dfbd5c47b4c4c02d5f5f15c1aff917e7ab480c21936184164 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14060 Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

Malicious code in @demopack/www (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...

Malicious code in heft-storybook-v6-react-tutorial-storykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5955868f72344703128add3301e3a85b51773de502f24e636fe0b9bba86d42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @caspianph/third-npm-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb03109285cde39b5336360926e9efaef2dd1ea20725eda1455e1ca5ec4b633e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13867 Malicious code in @years18/n8n-nodes-utils-helper-w (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bf341a3d4e6a362dbd4b46fa8ecbd4b612a10766846ab46662e8b076f69a8ab This package presents itself as an n8n workflow helper but ships a near-empty node stub nodes/PwnNode.node.js, 213 bytes while its postinstall hook a...

Malicious code in @noxzacode/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3082addf9f38493a38854287a70c75981ded28e693bf391917600680276a1ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13766 Malicious code in node-internal-svg-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea179fb3670844db867458418a68b3eb69dfd983ebe1fe96b2a4b41601266fc4 Package advertises itself as an SVG loader using well-known CDN providers, but exported functions getPlugin, setPlugin, and getPluginExten build a...

MAL-2026-13931 Malicious code in @dreamguyxeon/libsignal-node (npm)

npm/@dreamguyxeon/libsignal-node has the same import-time supply-chain tampering as @dgxeon13/[email protected]: on require it patches @whiskeysockets/baileys lib/Socket/newsletter.js with remote-controlled consentless WhatsApp newsletter auto-follow code fetch DGXeon13/strings after 120s,...

MAL-2026-13670 Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e6f280e621703ad0ddfe97298c5a5dded61dd1b8fc877729ad0202f6a23a77 Package [email protected] shows no evidence of exfiltration, install-time remote code execution,...