MAL-2025-145 Malicious code in chipped (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8b4d484b6a0b05dde597bbc9ba800eec0c201e3fc81387511d009ae01d5e07b3 The OpenSSF Package Analysis project identified 'chipped' @ 1.1.0 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2025-143 Malicious code in bridge-transaction-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db5956f81e131c01814a55fa4294eec8b2c4a0a037934a273bcefad48aca0599 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-139 Malicious code in snapon-imageviewer-lw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7053e8d93acd05ac2454f25c628ab30c641d481373e8f20a08b28a0f66e1fe38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cumulus-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f1f8e685a786d680773dae17f3fdca813dc627d1a031200036521aef32b1566 The OpenSSF Package Analysis project identified 'cumulus-dashboard' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in tagmyphotosblog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 68718b8c6a0e78b22dbddaeb5a6be69dac34b17d2e20d9a2fdf08d6bbbf95a00 The OpenSSF Package Analysis project identified 'tagmyphotosblog' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-132 Malicious code in keystone-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d1e499fbcaddce6bdea8ab5e0bf4a301d23b6db8e65cb2647376df41c9850cb2 The OpenSSF Package Analysis project identified 'keystone-app' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in utf-cleaner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 09b9e5c5deafbf756df5201976fdbdc3c61c10e815234df9aeb32764a3cd9652 During import, the package silently downloads and executes remote code. This code starts a web server in the separate process and listens for commands to execu...

MAL-2025-73 Malicious code in utf-cleaner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 09b9e5c5deafbf756df5201976fdbdc3c61c10e815234df9aeb32764a3cd9652 During import, the package silently downloads and executes remote code. This code starts a web server in the separate process and listens for commands to execu...

MAL-2025-38 Malicious code in alchemy-web3-webpack-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0baf7db6925882a96eddaa00b4877f9147183d9b00a85fd69b02e5fe625f7ff7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-37 Malicious code in shopify-ecommerce-shopping-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a28c4bb6f1ccd57758357f7949eda10b66b8dcc6c7249a4b0756f28d5517369 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @shadowbyte/checkout-telemetry-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3309a46cb7d7602b6b36a782d12752e0b69f409896afc9dd2d9fa4925d65b4a6 The OpenSSF Package Analysis project identified '@shadowbyte/checkout-telemetry-agent' @ 1.0.4 npm as malicious. It is considered malicious...

MAL-2025-34 Malicious code in @shadowbyte/checkout-telemetry-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3309a46cb7d7602b6b36a782d12752e0b69f409896afc9dd2d9fa4925d65b4a6 The OpenSSF Package Analysis project identified '@shadowbyte/checkout-telemetry-agent' @ 1.0.4 npm as malicious. It is considered malicious...

MAL-2025-33 Malicious code in pre-commit-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3f86360c5d5f5979a278474cb95f178bed388a7ce152931eee872318ac5fcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-32 Malicious code in hts-open-dex-react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71bfac5a5597cde45524360e887ab5bed0c9e5b8c5337ac9c0728b677529de56 The OpenSSF Package Analysis project identified 'hts-open-dex-react-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-31 Malicious code in innocent-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6fc7d792ebeefb0b83aeaecc6964d6288dced704804e70e6d7531b6a6dffc4a2 The OpenSSF Package Analysis project identified 'innocent-package' @ 1.0.3 npm as malicious. It is considered malicious because: - The package...

MAL-2025-26 Malicious code in @patternfly-v5/patternfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b43e835ee1484fff5f40f97988af91cf9adfabcef41f9bd4970a9eee273ee7ba The OpenSSF Package Analysis project identified '@patternfly-v5/patternfly' @ 1.0.2 npm as malicious. It is considered malicious because: - The...

MAL-2025-21 Malicious code in tree-sitter-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbacf70d3997892f49d729cbc0db29837ec65744402a0ae0c62460813e7f254f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12137 Malicious code in proton-parking-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 506697cca5654bda57571824a1c769ba976811a08a53a12e057f80fac4a610a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in contentsdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d682572d937337218240c73c90b9b0b4245feb639e633225bb21bf8f5fc32f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12131 Malicious code in contentsdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d682572d937337218240c73c90b9b0b4245feb639e633225bb21bf8f5fc32f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...