Malicious code in built-with-workers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f426ea9ad545f39f1e84cd26ee384b096d08c2b82f8b3554f97fc1ce85fac83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mathworks.github.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32e52ada951c82ef138dcd96976a00cb9d2e1c15f171f1b3c4768a030075bba3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in charjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30d644c2eb731d4dcad0bf39f80c41f09bddda4c07d8d2e90ce7a1e1b55716ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-360 Malicious code in arcus-cmd-utils (npm)

This package executes a base64-encoded script to download an Electron-based infostealer binary, aimed at exfiltrating cryptocurrency wallets, credentials, and other sensitive data. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware...

Malicious code in marked-as (npm)

This package is imitating the popular marked library. It contains a VBScript to extract a bundled PE payload, make it hidden, and execute it. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16c9c50d2f56b3edc3a26ddebf2c1da3ef628b3aa1c8da23bc2e5b0b2b157dea Any compute...

Malicious code in fast-utilz (npm)

This package downloads a second stage payload via Discord. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e23b4a6118c13cf6e7d7bc0318d4ff3f1d25bbc1cb4db2a8a4676cdb4777e232 Any computer that has this package installed or running should be considered fully compromised...

Malicious code in marked-at (npm)

This package contains a PowerShell download cradle to execute a Cobalt Strike beacon and establish command and control. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2adf9556402c124dc6a1146e6c3bb6a90efee66a9a0bbfdeb3188d4477099d2d Any computer that has this packag...

Malicious code in social-previews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fab6484159a8754b4345d5eadcd2182865514fcfa93f939fe2999845cf79a803 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in blockapis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dcc6d47857bf84c442515ff65b4504f036ccff55a5061b10b29abfb7d76a03e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdk-coin-ada (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c39dc006518bfc9ed3a2846ae2e407993b19b826cb2c30c0a31bace1a1ee06f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdk-coin-algo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ea750c35c4bec1006a22374fd7f8e5a426522380aa5d0566f1c97875ad977b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in viewport-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 267002a03c6d919765b3d26bea4ac822e509a4829c59b075764cecf051da4722 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in webpack-inline-constant-exports-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb8ae870fad74826ac57af33f27bdbe9e74f667ec62aac01b5c9e55a47d36001 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdk-coin-bcha (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a41b6c02dc6baa29b6ae516a437b5a11249d4b4937d56088fa5643e048905d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-314 Malicious code in tour-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44bfdd42ccd9f1335cf7f7b07ba399341a0a93af1c683563cf6a63697518f580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tour-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44bfdd42ccd9f1335cf7f7b07ba399341a0a93af1c683563cf6a63697518f580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-300 Malicious code in plans-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04b1c05ad3cb73c09f30ded556f336a88920f11ce91cba56ad301b3dd88ffd21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-305 Malicious code in sdk-coin-avaxc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae63f0d13a276525ec64ddd6d3b51601a6bb091953e45d505ccae7e2778574c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-274 Malicious code in blockapis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dcc6d47857bf84c442515ff65b4504f036ccff55a5061b10b29abfb7d76a03e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in request-external-access (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf57b443887e773384068e114f407f70b10c0278c6839c0d5c34f2ba575a63a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...