Malicious code in streak-math-abz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1eddf7b9d6d5331bdc1c1afe40913620b219afcc06a705aef3fe547ddc5cf25 The package advertises itself as a JavaScript day-math helper but its ESM main entry dist/index.mjs unconditionally spawns a bundled Linux x8664 ELF...

Malicious code in tsetnpmackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0077e1b925c48484cb4a130811a03da0959b9b35d3c9e6e9b819ac6d32e8bb69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in init-js-examples (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6005f6b51f3286b65f92b6c8dd73d51c744f89428bbb238f2186b61b7112e6c2 The package's postinstall lifecycle hook runs setup.js, which opens a TCP socket to the hardcoded remote endpoint 130.61.90.45:4443 and wires the...

Malicious Package

Overview albion-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to t...

Malicious Package

Overview amazing-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to...

Malicious Package

Overview gta5rp-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to t...

Malicious code in sidecar-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b48cc2cf1326bc68eda84d3c97733c367be4309d93c9671ad4d36f431bd0353 The package ships a single bin entry sidecar-mcp, advertised as a one-command setup for Sidecar MCP servers. When the user runs that command, the CLI...

MAL-2026-6981 Malicious code in paperclip-adapter-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d49d1a6c5381f58370cbfedc2321bd44796eb4ea79541d967a661760d9759801 [email protected] executes a credential-theft and C2 backdoor automatically on import. The package's main re-exports...

Malicious code in paperclip-adapter-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d49d1a6c5381f58370cbfedc2321bd44796eb4ea79541d967a661760d9759801 [email protected] executes a credential-theft and C2 backdoor automatically on import. The package's main re-exports...

PT-2026-56148

Name of the Vulnerable Software and Affected Versions uncanny-automator-pro WordPress plugin versions prior to 7.3.0.6 Description The software was distributed with malicious code following a compromise of the vendor's update and distribution infrastructure. This supply chain compromise introduce...

SkillCloak Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing

Scanners meant to catch malicious add-on "skills" for AI coding agents can be fooled by a few simple changes that leave the malware working, according to a new study from researchers at the Hong Kong University of Science and Technology. Their strongest trick slipped past every scanner tested mor...

Malicious code in vps-maintenance-paperclip-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48d7d517534385e3776097217c197836517e4f4d84ef29598724c4398bfc875e On import of the server entry module, a top-level try block detaches a shell process that 1 appends an attacker-controlled ssh-ed25519 public key to...

CVE-2026-10735 ShapedPlugin Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server

Multiple Shapedsmart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Product Slider for WooCommerce Pro WordPress plugin before 3.5.3 Pro smart-post-show-pro WordPress plugin before 4.0.2, Real Testimonials Pro WordPress plugin before 3.2.5, Produ...

MAL-2026-6215 Malicious code in aikaf6688812 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcdebe342ec1c629835301869934fab1a4800c98116a337ec33b05def92d33e7 package.json declares a postinstall hook that runs scripts/postinstall.js, which spawns scripts/shell.js as a detached, stdio-ignored background...

MAL-2026-5722 Malicious code in textwrap-toolkit-stager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fc85924d5672f7c91c2dd5e97c46cc48e3ae48084f906b7b0ba9d606c433fa4 On import textwraptoolkitstager, the package's init.py unconditionally fetches Python source from...

Malicious code in textwrap-toolkit-stager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fc85924d5672f7c91c2dd5e97c46cc48e3ae48084f906b7b0ba9d606c433fa4 On import textwraptoolkitstager, the package's init.py unconditionally fetches Python source from...

Malicious code in telebot-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d3c49bb558149b55f90b708ff47e24f6f856a88abb4b2ed477633c3df43d4e2 The package advertises itself as a configurable Telegram bot server README and.env.example reference TELEGRAMBOTTOKEN and ALLOWEDUSERIDS, but the cod...

Malicious code in @limebike/supreme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f65cdcb27200e24464982c0678d9dd556342d53886e4d5378da5d9c664fe1c7 Both preinstall and postinstall lifecycle hooks in package.json execute index.js, which collects the installer's hostname, non-internal network...

Malicious code in @tallyui/database (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d7af140ba49fc46f93bc668a317637f07fe952aa72fa5aaa3c3f16939d221ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in graphicsctxs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4786ca298bffb09916e622e06411ae44cb51c842a6eb9bf7bcf445c051463888 Packages in this campaign are used to exfiltrate data from users installing code from prepared Github repositories. Packages contain code to exfiltrate files...