Malicious code in @higherlogic/ocfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bbd559291bd6c2d7889aebe011bb43bef61938171904f5c9ff378f33fd9e5e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chai-spycore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbb99516f251bbd13baae5273239a6a04acefea76ddf1a7b06f4b5a328339dae Package republishes the chai-spies Chai plugin source verbatim including original author header under the near-identical name chai-spycore...

NPM: Decompress: Archive extraction can create files and links outside of the target directory

NPM: Decompress: Archive extraction can create files and links outside of the target directory vulnerability discovered by ? in WordPress Npm decompress versions = 4.2.1...

MAL-2026-6906 Malicious code in xnder-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aeeac149a5afa4797eea935b2a54b66fcf2cfd939fce855655208245ba9e5a7 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation of th...

MAL-2026-6901 Malicious code in vite-plugin-svg-paths (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3808a0ad54ecf36bb7d7da093b2a9982c01b87bcadb4ada918552c1738cf7fba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6888 Malicious code in tailwindcss-animatecss-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eceac19f8659a9b4fbca6de33a2c5ec75c732f50b6d4cee97e958546a201f64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in windrule-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12204dba8f73baf0bb7f6ce1ebd80bb2ce689752abaea290e1429aed4037bb9c No suspicious behaviors were observed in this package version. There are no lifecycle scripts fetching or executing remote code, no hardcoded...

MAL-2026-6872 Malicious code in rma-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fcbaad039ecd69789daa0857a674926917f7a439656144587a9fc441968e97c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6898 Malicious code in ts-relayer-pub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a8ec05f673f1d04b65918474a638737320ac81126814fd8be765bbdc2bb5c1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6895 Malicious code in ts-bigtn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fe9cda51a9c873f69575fec5aada84c81b0b7e907d060f28d6c6e95dc381911 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in color-cli-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43d15f0d189a3dff03fe5549073cad30c2c0d648e6b1b12d1385689c84c6888c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tracing-str (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 466143b5f195d4924e2227921a288954ecec9ed34d52af8ff433056f5ff56903 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6880 Malicious code in st-biginteger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f459f75f70d08e36cca4b9dc35ee7c90cb7010de9b77a4906444bebf174b013 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-scroller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57d21e3f2b10a543d5deb6a3999b78e5414b55ad958ff7811d802cb42386fc8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6887 Malicious code in tailwind-scroller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57d21e3f2b10a543d5deb6a3999b78e5414b55ad958ff7811d802cb42386fc8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6883 Malicious code in styled-text-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cd72b5d4bfabe627a3978222a01eb290f92c4714accb42faa26fb8ca9d2542f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6881 Malicious code in st-bigintr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e131cc31d56a484cba011c6188111c73f142866cfde721737180ce53cc3f96d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6866 Malicious code in prettier-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e5645051b8c021a473b5b5e8ffc5771c65265a02502beff5bef28932c4877cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6861 Malicious code in picocolor-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d3e751383a2838104b1052c4c7fd53fbbaa7205213e84939304080212ea64b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6843 Malicious code in lint-builds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e59bcbbdb88e5ffa12155537c268d8b8a50d9cfd88a462fe9219289e8226b772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...