Malicious code in semveer (PyPI)

Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install hook. On pip install, setup.py calls...

Malicious code in semveer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install...

safer-dependencies

Safer Dependencies for Claude Code When AI coding assistants like Claude add packages to your project, they often pick whatever version sounds right — without checking whether it has known security vulnerabilities, whether the package is still actively maintained, or whether the name is a typo aw...

MAL-2026-17694 Malicious code in @bitwardne/jslib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d Package @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form cu...

Malicious code in hardhat-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb The npm package hardhat-init presents itself as Hardhat initialization tooling and ships a README, LICENSE, and index.d.ts copied from the pino logge...

MAL-2026-17636 Malicious code in hardhat-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb The npm package hardhat-init presents itself as Hardhat initialization tooling and ships a README, LICENSE, and index.d.ts copied from the pino logge...

Malicious code in web3-eth-utils (RubyGems)

Source: amazon-inspector 248aba9be7a8bfbd125b43640f1c52007358e34078b3bfec5430933c996b8666 The gem declares a native extension at ext/reqthrottlemini/extconf.rb but ships no C/C++/Rust sources, so the extension entry exists solely to force extconf.rb to run during gem install. Before calling...

Malicious code in bitcion-ruby (RubyGems)

RubyGems runs this gem's native extension script ext/bitcion-ruby/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30 minut...

Malicious code in lighthing-invoice (RubyGems)

RubyGems runs this gem's native extension script ext/lighthing-invoice/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17606 Malicious code in lighthing-invoice (RubyGems)

RubyGems runs this gem's native extension script ext/lighthing-invoice/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in web3-eth-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17616 Malicious code in web3-eth-utils (RubyGems)

RubyGems runs this gem's native extension script ext/reqthrottlemini/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17496 Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

Malicious code in @nagular/router (npm)

@nagular/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

Malicious code in @nagular/core (npm)

@nagular/[email protected] impersonates @angular/core by name only; its code is an unrelated library described as "Core Libs" and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

Malicious code in exptred (npm)

The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17248 Malicious code in xeprews (npm)

The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exptrdd (npm)

The package exptrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in better-dotenv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf The package is a dotenv typosquat that runs a hidden Windows loader on every require and on CLI startup. dist/index.cjs and dist/cli.cjs invoke...