Malicious code in @keyv/memcache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 738202807ef51e0d987243e641bb2e97a2f4535bed388d631d80ead963a82b2f Package @keyv/[email protected] is a Keyv storage adapter for Memcache. No install-time lifecycle scripts, network exfiltration, credential access,...

Malicious code in @keyv/valkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77c74b9b7cab0e47c6f19a96a7ea44fd6d7c23989e4abdab3e708de9d6084d7f The package is a Keyv storage adapter for Valkey. No install-time lifecycle scripts, credential access, network exfiltration, dropper behavior,...

MAL-2026-12019 Malicious code in @keyv/postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16a1c036c4437e534d6eca401133f16bd83f08e0ca4b656c8bef0906eaad2a5 @keyv/postgres is the PostgreSQL storage adapter for the keyv key-value store library. The package exposes a storage adapter API and does not exhibit...

Malicious code in @keyv/cloudflare-kv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b3d12d9e6fc46545510e3656381bca3029ff156434a34d54b21ed45d3c4145a @keyv/[email protected] is a Keyv storage adapter for Cloudflare KV. No install-time lifecycle hooks, credential-harvesting behavior, obfuscated...

Malicious code in @servicetitan/suppress-warnings (npm)

npm/@servicetitan/suppress-warnings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in cacheable (npm)

npm/cacheable version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

Malicious code in internallib_v568 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755dfc0e12b6602ff21d04446f2c6bdc23499c0bd9645c14b9209dc25fbb0be5 [email protected] is shaped as a dependency-confusion artifact against a private package name. The main module exports a payload containing a...

CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

Malicious code in simple-date-formatter-util-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...

MAL-2026-11484 Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...

MAL-2026-11491 Malicious code in test-dev-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b3df759cd11b9c662bed5840b0671d4e9c54a76a606d284ca39390ecf51f8d [email protected] connects out to a hardcoded socket server host/port sourced from the test-dev-config module and enters a receive-loop that...

MAL-2026-11451 Malicious code in @spending-behavior-ui/widget-insights (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36bbaed8e8bd830b00f14eaeb532fbeeb0d581a806dbdbca220ab006b1adc958 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mplay-core-lib/utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eddb6f3032b394543236ca6a9378654e0d657ae7c80790126b90be036019607 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @global-theme/context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b48962d911b70fd09f4c001b44b879452dda607f877256d2f85d64538912ab7f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11450 Malicious code in @spending-behavior-ui/cashflow-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4297e338304a9686d295320c60149b746f9044b0cc158fc6743c670965f595fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11440 Malicious code in @meli-testing/jest-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a676fda55082dfbd3f6cb792419d9e7156f49a8c587526a37edf9cb09f535d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

MAL-2026-11455 Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

MAL-2026-11466 Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

MAL-2026-11469 Malicious code in iwomm-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc6a86a4bd25e85d55ccc7babe614b8cf8eb1b31572b67b1f463ad0302263669 lib/report.js imports childprocess, fs, https and os, collects host and user identity data via os.hostname and os.userInfo lib/report.js lines 160-16...