Malicious Package

Overview @yongot/canary-mcp-test is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances ...

Malicious Package

Overview tailwind-aspect-styles is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances o...

Malicious Package

Overview twilio-functions is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...

MAL-2026-16076 Malicious code in external_deps_enjoyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6 package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather tha...

Malicious code in external_deps_enjoyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6 package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather tha...

Malicious code in cat-sis2go-utils (npm)

cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...

Malicious code in @fyxzpediaa/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175 This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect reconstructs a UR...

MAL-2026-16070 Malicious code in @fyxzpediaa/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175 This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect reconstructs a UR...

CVE-2026-11363

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

MAL-2026-16069 Malicious code in reactlogo-load (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...

Malicious code in bx-ui-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8 package.json declares a dependency whose key equals the package's own name bx-ui-view and whose value is a plain HTTPS URL...

Malicious code in alloy-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80ee3815d12ec95aedb4bbe0d3de5c516e99163ca1eba52c2a3de7038b9a2ac0 package.json declares a preinstall hook that runs index.js on npm install. The script collects hostname, username, home directory, DNS servers, curre...

Malicious code in file-type-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04917bd7fc156dcb9793cb1f1d06ed0f2d0cb1b3aa4b04431dea54ed71f6be72 A clone of file-type-checker with one function added: isSignname, moduleName, offset in dist/validation/image.js reads public/$name.png from the...

MAL-2026-16054 Malicious code in gloggo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a333f8ded17af0754357d938933ee95e9ab1f857cc875948d49cb9b26992e75d gloggo impersonates the legitimate gulpjs 'glogg' logging library by copying its README, shields, and LICENSE text attributed to Blaine Bublitz, whil...

MAL-2026-16055 Malicious code in sonmors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e21634e32b7d24357ad667703da4ddeb42542ed9fc6a3ed28c7257d2e27fca Package sonmors ships a near-copy of the sonner React toast library and spoofs sonner's identity in package.json author Emil Kowalski , homepage...

PT-2026-88788

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and...

CVE-2026-88002: Loop with Unreachable Exit Condition

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruction helper in backend/openwebui/utils/misc.py advanced through a chat history by map key but tracked visited entries using each message body's optional id...

Malicious code in toru-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...

MAL-2026-16057 Malicious code in toru-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...

Malicious code in tailwind-aspect-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in th...