MAL-2026-10709 Malicious code in @cyberrant-rantai/rantai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41d1dbf6fb83f9a7c4c4b94ee40255e86910714400e249fec55b031e809c92bd runtime/localagent.py opens a Socket.IO client connection to a hardcoded server at https://app.cyberrant.org overridable via $SERVERURL and registers...

Malicious code in channel-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb42c8663e71b69abd887afe5b53f3c9d57bb405dd9e8ec4954eb1bf9bb0c033 The package's runtime code implements a remote command-and-control agent rather than a normal library. bin/cli.js hardcodes the endpoint...

MAL-2026-10729 Malicious code in channel-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb42c8663e71b69abd887afe5b53f3c9d57bb405dd9e8ec4954eb1bf9bb0c033 The package's runtime code implements a remote command-and-control agent rather than a normal library. bin/cli.js hardcodes the endpoint...

Malicious code in bvm-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87ff2c7d903c5594ba5fa2e11d3fe6281380a5f2d010a1a0e3c0679464ab1fca dist/index.js in [email protected] imports childprocess and issues fetch calls to the hardcoded host https://bvm-core.nexsail.top at the top of the...

MAL-2026-10728 Malicious code in bvm-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87ff2c7d903c5594ba5fa2e11d3fe6281380a5f2d010a1a0e3c0679464ab1fca dist/index.js in [email protected] imports childprocess and issues fetch calls to the hardcoded host https://bvm-core.nexsail.top at the top of the...

Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d9a3395e3bbc1bae774ea99bb4100a3db071a6b4527eaba0ae9089eb51bf268 The package ships as an agent daemon whose bundled entry dist/index.cjs, dist/core.cjs connects to a hardcoded WebSocket gateway at...

MAL-2026-10721 Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d9a3395e3bbc1bae774ea99bb4100a3db071a6b4527eaba0ae9089eb51bf268 The package ships as an agent daemon whose bundled entry dist/index.cjs, dist/core.cjs connects to a hardcoded WebSocket gateway at...

Malicious code in @agentvox/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0482819726a3b7e7f36315f58ee95e3017bc649c2ea89958776c4985fe32ab The host daemon opens an outbound WebSocket connection to a hardcoded default proxy https://proxy.agentvox.bot and, on receipt of a session.open...

MAL-2026-10706 Malicious code in @agentvox/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0482819726a3b7e7f36315f58ee95e3017bc649c2ea89958776c4985fe32ab The host daemon opens an outbound WebSocket connection to a hardcoded default proxy https://proxy.agentvox.bot and, on receipt of a session.open...

Malicious code in phantomx-tool-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e528800706b219f69d8bc87eb77203c752c8b4720e8c0b8fc04cad6df8ce1d When the tool-server bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers...

MAL-2026-10745 Malicious code in phantomx-tool-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e528800706b219f69d8bc87eb77203c752c8b4720e8c0b8fc04cad6df8ce1d When the tool-server bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers...

Malicious code in sakuraai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e When the daemon is started e.g. via sakura daemon start, the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a...

MAL-2026-10746 Malicious code in sakuraai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e When the daemon is started e.g. via sakura daemon start, the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a...

Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...

MAL-2026-10757 Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...

Malicious code in darkglitch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...

MAL-2026-10756 Malicious code in darkglitch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...

Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99621af0900df34246c87811ea5c2a643f2b3805601136dcc0a6768e48af925f The PyPI package captcha-solve-api contains no captcha functionality and is instead a binary dropper disguised as an analytics SDK. A custom setuptoo...

MAL-2026-10755 Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99621af0900df34246c87811ea5c2a643f2b3805601136dcc0a6768e48af925f The PyPI package captcha-solve-api contains no captcha functionality and is instead a binary dropper disguised as an analytics SDK. A custom setuptoo...

Malicious code in airflow-provider-spirit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84edc3b5fdf650aec875a1381b60bf2bb811f0c813ca6841052730fcee025bc3 The package is published as an Airflow provider but ships no provider code. setup.py installs telemetry.pth into site-packages, which auto-imports...