1778 matches found
Malicious code in pfp-block-mobile-past-meetup-list (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf58f1cbe01e2a0634ec464f040fc08dadf2df035af8c8a68d1fea1d51f10a85 On require of pfp-block-mobile-past-meetup-list, index.js loads ext.js which runs a bootstrap routine. It fetches a platform-specific binary via...
MAL-2026-12245 Malicious code in tinkoff-pfp-atom-desktop-carousel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72e139cae8466fafe604673154859640f78b9757aae859dcb8f9df07d26184dd On require of this package, index.js loads loader.js which selects a platform-specific asset path, downloads a native binary over HTTPS from randomiz...
Malicious code in simple-date-formatter-util-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...
Malicious code in veldora (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a848da2622d0adc27e55e1a650c39892aea7ef22c81c4c6ed4e5b6dc64809de Package [email protected] was scanned across 6 files. No evidence of install-time or import-time execution of remote content, no credential or environmen...
MAL-2026-10824 Malicious code in @gocortexio/npmgremlinbox-gpl-2-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab52db644e1790e6fec7814ae119abd04ec6cb63173abc691f34ede1d7959b0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10771 Malicious code in trongridme (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 04117292d543eae5a1d22c78d8a4507cc196c8770c9fb0a09ae2f9a10a8009d4 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
MAL-2026-10581 Malicious code in process-status-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on...
MAL-2026-10488 Malicious code in permcarmserver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...
MAL-2026-10283 Malicious code in another-poc-by-tipsen (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1bd73ac39644da27df81fcbc6540647d0f13d77419a07997a8ca0a2baa6164e package.json declares a dependency safe-chain-test sourced from a tarball URL on an anonymous Cloudflare tunnel host...
MAL-2026-10366 Malicious code in ratelimitsucks10 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ea43317a905d4e9b4a22dac3a0e325d92493557c5dc6b376f2e05d84d2fb29a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-7376 Malicious code in reauctjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in ztargetpdfs1 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9742 Malicious code in zrgvqaf6f (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-9187 Malicious code in wandday26x (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-8806 Malicious code in sm8230mamd (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-8654 Malicious code in slncbiuaqy (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in hwc0v (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in fosscalwands (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7501 Malicious code in aiuzubwjbsoj (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-6944 Malicious code in zredis-typed (npm)
zredis-typed is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign Wave 4. It was published by npm account 'donimique' [email protected]. The package.json description 'Node.js integration layer for Autodesk Forge' and the bundled README.md literally...