MAL-2026-11212 Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

Malicious code in curse-dependent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6342746f5661955d0e66fb46f981245d41062c23e1209f3f2b62dc469638a41c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spectral-corsair (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c77441a8038182fe252b5782f82b900831bb6e4b598944ed0edfb4093e5fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11384 Malicious code in spectral-corsair (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c77441a8038182fe252b5782f82b900831bb6e4b598944ed0edfb4093e5fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcssss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0da18df9b0c152f27cf8431c3ac342f3dd15d7a94ade13a40a7ee7dfcba1614d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11393 Malicious code in tailwindcssss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0da18df9b0c152f27cf8431c3ac342f3dd15d7a94ade13a40a7ee7dfcba1614d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11309 Malicious code in famshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25590ceaca7a7491267e3152f276e90e1d5dd7eee7f3a86bee0c2b7666c0427 No a static rule matches and no traced-code findings are available for this package version. With no concrete behavioral evidence in either signal...

MAL-2026-11221 Malicious code in @patternfly-4/react-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d910906cc783762621ef10ef92572495ce92e5424903edc1245045d2092793f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @patternfly-4/react-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d910906cc783762621ef10ef92572495ce92e5424903edc1245045d2092793f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @patternfly-4/react-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af8f4323b56b57abb05cba88f31a1c04f8fbe92935757e681460c6d66f032e96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @patternfly-4/quickstarts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5c84bc12cb0c8215b572e242d8268710430f7bb4c16d7ce4ac25a072cd39e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @patternfly-4/react-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5f54e5643951668f9122f9909e456f67938b47d7ecb0cddf1fde02666a66ddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11219 Malicious code in @patternfly-4/quickstarts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5c84bc12cb0c8215b572e242d8268710430f7bb4c16d7ce4ac25a072cd39e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @grua/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1eabb3f38128e34522c4bca5893ed0e64bcbc213ef2f617cce26e584c220c037 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11213 Malicious code in @grua/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b0588f2a4e3843bee403528cb8502b7c4207d2ce3179e51649b3951f8a8d2b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11214 Malicious code in @grua/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1eabb3f38128e34522c4bca5893ed0e64bcbc213ef2f617cce26e584c220c037 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11211 Malicious code in @ethers-sdk/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38a8c103dc06261576987809af8a1deb696dfdabd93bf4116f42ee199ee77cc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in compose-logger-stand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34de797bc2020fd52b9b36fda8513a111610612c3a50e75d8ea8a79440be4f0 [email protected] presents itself as a logger but its shipped code implements a credential-harvest and exfiltration pipeline...

MAL-2026-11267 Malicious code in compose-logger-stand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34de797bc2020fd52b9b36fda8513a111610612c3a50e75d8ea8a79440be4f0 [email protected] presents itself as a logger but its shipped code implements a credential-harvest and exfiltration pipeline...

Malicious code in ember-livereload-indicator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 205eabc38fa6c38df3ea030cae6621b16235960c048a8eba382c821863c91da1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...