Malicious code in @zaka13/zakasite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15276369023f332e049b1b25b23be8b056ce333649434f79d0f41f3bbb1930b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lib-bb-html-sanitizer (npm)

Source: checkmarx 74072bddc9908e0147976fde0680c197ac5b38167bfcdf14afc5f79f23749f72 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in kaluza-careers (npm)

Source: checkmarx 7fc6bb8e84e2499d431b69a1efe08fbdc626b2801e898180833dde64c951c39e Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

CVE-2026-90946: External Control of File Name or Path

DeepWiki-Open through commit d92819a contains an arbitrary file read vulnerability in the unauthenticated /ws/chat WebSocket endpoint that accepts repourl as a filesystem path with no containment. Attackers can supply arbitrary directory paths to read all files with supported extensions including...

Malicious code in hideorg-lvl (npm)

Source: checkmarx cadb232e4b479810d217f2adbfed5e8dba555837082c21bb6fc0501c0686c462 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ossf-package-analysis ead8b3662c808468abcb65cf3b14e15d072c5a55ab367208aa9d43279d39e353 The OpenSSF Package Analysi...

Malicious code in developer_backup_test531 (npm)

Source: checkmarx ba34269365aec86c0211ee348c1cc4f84e68214a7aed51304d8a309857881001 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in developer_backup_test527 (npm)

Source: checkmarx 873572cb006dd8216d097e1014bc26f4f54e2e57b00c4ed5db617993287c9735 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in developer_backup_test525 (npm)

Source: checkmarx 801d93e817d2a88be92c4ce8b23fb15ec2a02dba59eea3666d03eee45d2dd072 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in anime-vostfr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f624a7b8a2be52c79af7942acc5717ff29fa17cec42dce635c26839deb8e06af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cxp-jquery (npm)

Source: checkmarx b0e4725a2db5433915386ce19dadd7812b0f44e9afcb7c48d855797cf7a78537 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in cnp_al_corp_front (npm)

Source: checkmarx ca87bb9f11572bb7178a087d94273972886a104b0d9f9b25ea8799b418f8c85c Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in angular-1.8 (npm)

Source: checkmarx 3d45e146db01c8e2d986dd73f9991c083be30195ff986c99817c93e1be410b60 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

Malicious code in ajaxmanager-custom (npm)

Source: checkmarx cbfc18e18de3ecf81548e9fff07c310df0c09ae04271fbe4e2f3e6872af6c549 Malicious packages campaign since 2021 targeting developers, steals source code and secrets --- Credit: OpenSSF source...

MAL-2026-14908 Malicious code in 3layerdipstackrkxyr1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2531bc57919ce75f018da4d6a17d90c972a5141255d11b202af2952c81bb7fd1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackfm45yj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12b1ddf92d052ad44338e1b280af5bb2903f102a0de716e1186cde47c0669282 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in webpack-cdn-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d26374bf1ca7d23122c91a5e03e9783f1ca78deed6d8b97ad9988a4d1184ff95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14125 Malicious code in @guildai-services/guildai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd47a423c934111e427e5db6e85d5f4393272e0a662818840887dffe409f1c21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13996 Malicious code in @nolimit-agent/linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a61df0713e6ffb3921a4819c4c80540bfd596d8b71e4f2015f3ed580c9f804d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13824 Malicious code in mnteckets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caa458e1b7c6ca828e971aa0dac44b11b2f20aaf55652235ce2a4c5ce1c4fd66 The tarball contains only package.json and index.html. package.json declares no lifecycle scripts preinstall/install/postinstall/prepare and sets mai...

Malicious code in csbcldfvivwfgd4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6d7db017a0499c0fca67cc331c44fa736fe52568177990823cb17bd03ceee21 The package contains a single index.html declared as main. The HTML mimics a Cloudflare 'Just a moment...' challenge and contains obfuscator.io-style...