MAL-2026-10145 Malicious code in motiondnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11d8d84a54d776c1b4d6b53bdb39c8b181d9bfde03da128c7b3f58d6fb631284 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10146 Malicious code in ng-search-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 095a335a93f1ebe0047f2cdf56c2d52551d7c8602ade2e850486a6e19f514545 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polygon-gamma-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49bd3ddb3340e0ef3c76465b6e275d45ddc8eecdbd742747acde8588a2018b4 [email protected] advertises itself as a 'TypeScript SDK for the Polymarket CLOB API' but ships no Polymarket API surface. The exported...

Malicious code in mdb-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24ffe7ac6e64aab50d9ba84f5b06ffd1047663698d25071770749b36afe6543 The package's default export getPlugin performs an HTTPS fetch to https://svganchordev.net/icons/107 with URL components split across protocol, domai...

Malicious code in marked-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bfc3b729c08e0882fe0f653f436c2b7e1fdae0379748c12e0f9266f6c69c963 The postinstall script scripts/install-check.cjs fetches a JSON config from https://trabalhos-flax.vercel.app/config/clob-math.json read from...

Malicious code in eslint-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8908ac72050dded53e2e163c528a446b7a4fd7a37a4874e14f95b08265f043c4 The package presents itself as an ESLint-inside-Jest runner but the documented linkProject/lintFiles/createJestRunner API is not implemented. The...

Malicious code in execfences (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 974c5744c98a462c30d6c8dd3ca078461dc172244203e85d5290fa05660d2d1c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in nodemon-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5488028be686500c0af6b7f91ead55be9ddaeb86f3b920fce7eed6f8111b0050 Package name, README, homepage nodemon.io, author remy, and source tree are copied verbatim from the widely-used 'nodemon' package, with the addition...

Malicious code in workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a299d08a926a020ab738de2ff3aee9ccbbdea3f90fc93c0a7a0d2ab8e8b22724 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in workspace-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 337be691dd0efaac223695a5cb4f51ab5cdcc6b3ccde983b86d7256b10d731a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10113 Malicious code in workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a299d08a926a020ab738de2ff3aee9ccbbdea3f90fc93c0a7a0d2ab8e8b22724 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10112 Malicious code in workspace-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 337be691dd0efaac223695a5cb4f51ab5cdcc6b3ccde983b86d7256b10d731a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nodemon-patch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15ac606888cb1a54710bafa78dc76d760bef1088bb5e2cc0f0323614341345e5 The package is named nodemon-patch but its package.json metadata homepage https://nodemon.io, author Remy Sharp / github.com/remy, repository, fundin...

Malicious code in nodepack-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b976e6ab638a52663d25f360bffec6706dc82991ad27c552788a5a4d785ff89f The package presents itself as the popular pino logger README badges, file layout mirroring pino's lib/proto.js, lib/redaction.js, lib/transport.js,...

Malicious code in @kl-starfish/test-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b554249a85dcce61ed69ed5552bd6486b14a3ab2d72b7b243638a8ea24a8339 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in n8n-nodes-mcputils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa6d921f2167545e1c8e1a4dfa9981a2b9ce2878b1406608d4673aadd00a761b The package poses as an n8n community node for MCP utility helpers but performs unrelated binary-dropper actions. The postinstall lifecycle script ru...

Malicious code in qlkube (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51bbdab9d33c291290e2f871acd2ebf7bf64c2c66c5124592055669771b6301e The package's package.json declares a preinstall lifecycle script that runs curl https://cwcie03pzedo62twgbs3x6e9l0rsfk39.oastify.com on npm install...

Malicious code in clavue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ffc14d0e15af336ff2709e543272d2386d767fe185b380c5f2c2baeb78c3cbf The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in calvuepro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9de2057a076c31ca107db2c3e8d330a7b4aa2d8d67896cecd6c7ebef21d07731 Package ships a 5.7MB prebuilt darwin-arm64 Mach-O at vendor/clavuepro-darwin-arm64 with no source tree, no hash/signature verification, and no...

Malicious code in clavue-agent-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 399c0d2f1fabfa46b35810b70797862a0fd469076fa9496549237ab413ccada2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...