MAL-2026-11317 Malicious code in host-inspector-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94f6b6fa0236d92aa637686aea23b70cb31900bb701c70d77397fd3da25f2bd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11373 Malicious code in rph-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dcb5532513af2a6e42d28be7ddfccc99a57b576460f797761b64d6ce5cf90ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sunpro-3dmodel-renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27ab648ee61e8b9dc571927ea620226125fc419eaa13f7c2bda53767a7453189 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11362 Malicious code in qserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f38e6b7e00f8dcf90ed3683783ed77c81e4eb0a457d33656b14194048625301 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11236 Malicious code in android-web-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5df19b4396c3027870b8afcfc6ed1d52e466f5f63187716dd1262499e3ab20b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11379 Malicious code in shsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49d4f90386ec40022f0fad868c745b30d446963edadf0e8fe1a3a4a338ce02d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-test-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1347a031977c76d8945813d129567addafb91c3bdc49eaadcd329f61ef72304d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in merg-descripters (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f76e5609bceac9f395143e5329a0187c6ba35512bf453587bc2fe114622508b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11305 Malicious code in express-test-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1347a031977c76d8945813d129567addafb91c3bdc49eaadcd329f61ef72304d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

MAL-2026-11212 Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

Malicious code in discord-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3c1bd5721d48e92da2ea3b06abe4b3343f6aa6b48224534c89c04d6a8252cff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 203ee4d21fc1df2921367505b508c20e236b7eff515ec18e76ba29d22db661bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11280 Malicious code in discord-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3c1bd5721d48e92da2ea3b06abe4b3343f6aa6b48224534c89c04d6a8252cff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11278 Malicious code in discord-ms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 203ee4d21fc1df2921367505b508c20e236b7eff515ec18e76ba29d22db661bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lodash-ex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ddc129136b388cfe448e3253a312b7a54ddc90993e77f4e91fd859b08fbb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ag-grid-boost (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b48a0535bdc8dc48399716c0e05646161556ce93b7b3cfeb7ba095e9bc3e1df5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in imut-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bd7ca3cbe4743cad9e7368e601776bae62d8de0b6439b33a446efba71d12b3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-ag-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97513e8d4f7818787a09bd36b9c59997b9c98aeb4d731662c4092cb37fe9d687 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11327 Malicious code in lodash-ex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ddc129136b388cfe448e3253a312b7a54ddc90993e77f4e91fd859b08fbb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...