Malicious code in kingasd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cea57ed478ce7d494e8daba01d75b4c47a41bf4cc2bcce462a405cd46ea1a4 The package kingasd was found to contain malicious code. Source: ghsa-malware 13d287b8649f8ab3c2db046c9db2af68601de7e168725a1440764bd4f6c03400 Any...

EUVD-2025-37293

Malicious code in gunpowder-ghost-curse npm...

Malicious code in bael-god-thanks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fb105ca33158c030cf28b649844c05d95a90e00aae8866710025a5ea6ed43a0 The package bael-god-thanks was found to contain malicious code. Source: ghsa-malware 1ada7d14f26d17acaa1f5bc8625c26c9dab2ad3018eeff170305cdd60e45247...

EUVD-2025-37206

Malicious code in dynamic-import-node npm...

MAL-2025-48835 Malicious code in eithernet (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-191908 Malicious code in tosa-serialization-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5badd7c7414eb1f6fbdf1934b42ffe74549daa74508afd092af853097170eb8e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in redirect-cwfpnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b0953ee0666a602bb2917d54216617564fa62b9be8059a5990db2f5635ff35f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-l6qi9e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea7c9759afb33de9be7fc7e051d5e7c5b3f74868b9887fec3b2e4d7b892d3fa2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48022 Malicious code in astra-db-recommendations-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f406ad9e38dd12903b516bd5bc543aee1c02d1e5641d513bf0a6d1ddb9ce7f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47960 Malicious code in qweqweqwexxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8eb4579b71df57bf70c32bdf8375874927db8256e0dbeb573b748d12439bbe26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2012-1880

Malware in sbrugna...

EUVD-2025-10729

Malicious code in bioql PyPI...

EUVD-2024-44715

Malicious code in bioql PyPI...

Malicious code in @sev-ui-verse/api (npm)

The package @sev-ui-verse/api was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 414d159764ceef8011dcd7e75ef5fbfb99ec42da34486271031460875812f54b Any computer that has this package installed or running should be considered fully...

MAL-2025-47355 Malicious code in ts-imports (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eccb885c4d87f75ef3479173055a689c6b90773619272c8ccf891bd342a7128b Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47226 Malicious code in eslint-config-crowdstrike (npm)

Suspicious postinstall script executing bundle.js combined with unsignedbitwisemathexcess YARA rule match indicates potential malware. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5700b3786b16cd76be2c86bc19af1fd76ac0dbfa6bb16f29e3837fc94598b75 Any computer that...

CVE-2025-59331 [email protected] contains malware after npm account takeover

is-arrayish checks if an object can be used like an Array. On 8 September 2025, an npm publishing account for is-arrayish was taken over after a phishing attack. Version 0.3.3 was published, functionally identical to the previous patch version, but with a malware payload added attempting to...

CVE-2025-59144

CVE-2025-59144 concerns the npm package debug . On 8 Sep 2025, the npm publishing account was taken over via phishing and version 4.4.2 was published with a malware payload that attempts to redirect cryptocurrency transactions in browser environments (e.g., via direct script inclusion or bundlers...

CVE-2025-59140 [email protected] contains malware after npm account takeover

backlash parses collected strings with escapes. On 8 September 2025, the npm publishing account for backslash was taken over after a phishing attack. Version 0.2.1 was published, functionally identical to the previous patch version, but with a malware payload added attempting to redirect...

Malicious code in @liquid-web/common (npm)

The package @liquid-web/common was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2152309995aeb57c2d293acf6ebb54fdc8e47239ba56a4b742bd00743a7468a5 Any computer that has this package installed or running should be considered fully...