MAL-2025-6753 Malicious code in rca-url-adaptator (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a4c404a67ab59319cbe0468f8814fdb2d770576ff6c1e58b816b178705447f3 The OpenSSF Package Analysis project identified 'rca-url-adaptator' @...

MAL-2025-6787 Malicious code in flatfox-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c1abb243ceb7b5b94ca2f950d7cf27838ad4c22bc9771a0ea878af5497bfebf2 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-6348 Malicious code in resource_registry (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 97ad7e4a2d8c7feaee7f61db0f1f57c90f92b4f92d6ca258fef4bc5f5107666d The OpenSSF Package Analysis project identified 'resourceregistry' @ 1.0.22 rubygems as malicious. It is considered malicious because: - The...

MAL-2025-6337 Malicious code in @xcxcxxx/gsap3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2b40f953bb5a5912e570360e414e6cfa40076203e4625982216196baf98874e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6336 Malicious code in testing123kk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bebd39f4de86af5e9634fbfda5f8c97794b597b1066c2fcd32e3a2068569280d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-6329 Malicious code in momentjs-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f28c9895f79a0a36ce23a5aa43824f3819d75b0736b6650523b5f4dc6aa0babd The OpenSSF Package Analysis project identified 'momentjs-poc' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6255 Malicious code in redux-probe-unknown-action-rce (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d273d8be87dc1aaa71222024d9f545d4ec9bde08234f27b0c9c81f6dd8c86721 The OpenSSF Package Analysis project identified...

MAL-2025-6249 Malicious code in @grafanacloud/test-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86fad9166303d847c44fd5532ddf9f11a1b00f4d412bdde3435415be2bdd4b5e The OpenSSF Package Analysis project identified...

MAL-2025-6241 Malicious code in budoux-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b648f8e2f3161c2d499b10cce27dfd7bc034fc56857168b74c85c0dd29d03fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6227 Malicious code in react-is-builtin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec8b0c72c247f12884f7dd1d983f39af01544eaefed640dec15bd838e4b3473d The OpenSSF Package Analysis project identified 'react-is-builtin' @...

MAL-2025-6222 Malicious code in ids-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f020e163d0a577209cc845c050e3c05d1227f790c1e49a6ed7acc1e0d7efae4c Any computer that has this package installed or running should be considered...

MAL-2025-6007 Malicious code in groq-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f310f1669db9ce74e36d92085a6a67098f7c0ee086d8da5998b709d565a3fe12 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-6209 Malicious code in marcom-ac-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 64d378ac078f27f1f0357746b50307c933999c2eb82b5c9c7a7a6b0645910749 The OpenSSF Package Analysis project identified 'marcom-ac-console' @ 1.0.5 npm as malicious. It is considered malicious because: - The package...

MAL-2025-5983 Malicious code in npmdeco (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7c7110ed52ce1bc50ece55d4ed6f010f23d0ec5383c3b482208028e97eeab9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5981 Malicious code in @hub-la/payments-proto (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 788034b39545c288d45be9fa12e76155c224c8537b86eed7b0aaf0cf4e501908 The OpenSSF Package Analysis project identified...

MAL-2025-5846 Malicious code in yandex-metrica (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c347c0cd149f59328faebe4ea3eaf82b02f9eeb1971ee50b89880ccff4620e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6210 Malicious code in mgz-testpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c82f0658f0d08613ec76f5066bad323001a5a95afc35b8befc4a34c82a68e0a7 The OpenSSF Package Analysis project identified 'mgz-testpkg' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2025-5844 Malicious code in ngf-gov-hr-navbar (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 85f2baa5c5673490af93199349e0ef54f7c581115b1fa83d6df2c9e18430e031 The OpenSSF Package Analysis project identified 'ngf-gov-hr-navbar' @...

MAL-2025-5841 Malicious code in xpvnsulc (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88e144cce5913bd8b818e88d9308fd1c10c0c7d58d905c8e570425d7c5f7ec49 Any computer that has this package installed or running should be considered...

MAL-2025-5837 Malicious code in test-package-avinav (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 db665678ac908b6f9aa76ef069759ebd70b62c901a6f840b765ba7cac299c423 During installation, a heavily obfuscated code is executed. Exact behaviour unclear --- Category: MALICIOUS - The campaign has clearly malicious intent, like...