MAL-2025-6255 Malicious code in redux-probe-unknown-action-rce (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d273d8be87dc1aaa71222024d9f545d4ec9bde08234f27b0c9c81f6dd8c86721 The OpenSSF Package Analysis project identified...

MAL-2025-6249 Malicious code in @grafanacloud/test-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 86fad9166303d847c44fd5532ddf9f11a1b00f4d412bdde3435415be2bdd4b5e The OpenSSF Package Analysis project identified...

Malicious code in foundry-jupyter-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8114162af3676e6c75f96e1dc953dae363e41fab4e9b3ce75a84b261aece0113 Installing or importing the module triggers exfiltration of environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-6248 Malicious code in foundry-jupyter-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8114162af3676e6c75f96e1dc953dae363e41fab4e9b3ce75a84b261aece0113 Installing or importing the module triggers exfiltration of environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-6241 Malicious code in budoux-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b648f8e2f3161c2d499b10cce27dfd7bc034fc56857168b74c85c0dd29d03fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6227 Malicious code in react-is-builtin (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ec8b0c72c247f12884f7dd1d983f39af01544eaefed640dec15bd838e4b3473d The OpenSSF Package Analysis project identified 'react-is-builtin' @...

MAL-2025-6222 Malicious code in ids-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f020e163d0a577209cc845c050e3c05d1227f790c1e49a6ed7acc1e0d7efae4c Any computer that has this package installed or running should be considered...

MAL-2025-6213 Malicious code in donotinstallthisistest6 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 272225f1adba5810796fd9c194041e72e5fcdcc032fa296a701bcc480b37bfcb Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-6007 Malicious code in groq-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f310f1669db9ce74e36d92085a6a67098f7c0ee086d8da5998b709d565a3fe12 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in marcom-ac-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 64d378ac078f27f1f0357746b50307c933999c2eb82b5c9c7a7a6b0645910749 The OpenSSF Package Analysis project identified 'marcom-ac-console' @ 1.0.5 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6209 Malicious code in marcom-ac-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 64d378ac078f27f1f0357746b50307c933999c2eb82b5c9c7a7a6b0645910749 The OpenSSF Package Analysis project identified 'marcom-ac-console' @ 1.0.5 npm as malicious. It is considered malicious because: - The package...

MAL-2025-5992 Malicious code in ngx-satoris (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 673e3bc6e9e3b3d52385697990c722fc2d418dcb3169950ac1063ae5b0371c1f Any computer that has this package installed or running should be considered...

MAL-2025-5983 Malicious code in npmdeco (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7c7110ed52ce1bc50ece55d4ed6f010f23d0ec5383c3b482208028e97eeab9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5981 Malicious code in @hub-la/payments-proto (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 788034b39545c288d45be9fa12e76155c224c8537b86eed7b0aaf0cf4e501908 The OpenSSF Package Analysis project identified...

MAL-2025-5849 Malicious code in ringcentral-google-drive-notification-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afbe2fb4071ec030a6a51319f5f0b9d45664bf8caba681cfac58bb60bd001cf0 The OpenSSF Package Analysis project identified 'ringcentral-google-drive-notification-add-in' @ 2.2.2 npm as malicious. It is considered...

MAL-2025-5846 Malicious code in yandex-metrica (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c347c0cd149f59328faebe4ea3eaf82b02f9eeb1971ee50b89880ccff4620e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in workspace-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6337f633e71ac4bbdd2541a6ff172f67246451a691838940e3578c7c7ba4ee18 The OpenSSF Package Analysis project identified 'workspace-loader' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6210 Malicious code in mgz-testpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c82f0658f0d08613ec76f5066bad323001a5a95afc35b8befc4a34c82a68e0a7 The OpenSSF Package Analysis project identified 'mgz-testpkg' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2025-5844 Malicious code in ngf-gov-hr-navbar (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 85f2baa5c5673490af93199349e0ef54f7c581115b1fa83d6df2c9e18430e031 The OpenSSF Package Analysis project identified 'ngf-gov-hr-navbar' @...

Malicious code in ngf-attachment-item-view (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2862be0c2ae4ba5cbde25d09e095fa5b52216a185072b7f27f26052224b2241c The OpenSSF Package Analysis project identified...