MAL-2025-178 Malicious code in dbx-js-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2191dabfd9180ad79d00f6678faee7b75417b6a5ee484798bff290a81fa0d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-182 Malicious code in dotgov-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 474b190c86043a8da1444eb865e6a6214a6aed8aa0fd62aa37726ebc44850bd2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-183 Malicious code in emoji-datasource-google-blob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3653a56d9d36fb380b98090ef118578ceed822d7bb1ab1a62d6a18fba5ed5b2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-212 Malicious code in nr-reports-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83a07c3a21ffff09fba609e9879fbf9abb20469637967f526c6ef288a5bfeeb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3cx-call-control-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca09aeb5dd1513eb46048a6987f18b72f8c9f52ba8340cefc8521c2138be8503 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-254 Malicious code in uber-direct-js-sdk-examples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30ee8294ed2bcf683f478b647f9919d6b45e0651905c29ada14a3ce392168447 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-129 Malicious code in jssdk-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80c132d5e9d9ea8c65f7c252909ff66d20a611adce2c58734305e4fe06254319 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-107 Malicious code in uber-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b42422c68e4256dc883e7d5e02350870cab3c0068d92985ffa4c4bc4ab43df8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-109 Malicious code in uber-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ddfbcc0bce009349873248f526418b14cb9c9f9b575e74b3fc1787fda4af9b76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-106 Malicious code in uber-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 514527f85a2deb8975f95374694c5dc8a3d09d328d3cb7adc36ea16d071367ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-100 Malicious code in reqests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42036342744aae89af66ec705147456c19ef5f7f242f7d91251ca0bac5fe12ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-116 Malicious code in zqdl55513 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a623c3e69f707a5c5284a6e298d4d5149c282064e65985928f1277cd258d87d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zqdl5551 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbd5f002e9be6ed643e4f041658ca89255b5c1a056c671f58ff4d1ef4257e908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in marked-cs (npm)

This package deploys Windows gh0strat malware via VBScript --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f49714fc5f2d734162fbcc4c7c4552ec6d6e89b81109ba8652c3d057686022 Any computer that has this package installed or running should be considered fully compromised...

MAL-2025-39 Malicious code in dexscreener (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 294308d3c6b462aa1ed7e43894f66f1fefe347cc188fd9a360649f1c03b0fffc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-41 Malicious code in solana-transaction-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 786862cc5bb54e2a1b9307f03e4cd67b11a7325ba9c251b3695b08d8e3383c58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tree-sitter-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbacf70d3997892f49d729cbc0db29837ec65744402a0ae0c62460813e7f254f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lambda-demo (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70fa7a653e95d7b948968c1605f557ae4f569e78a26d160f8768a44bca1b6f5b Any computer that has this package install...

Malicious code in babel-preset-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c7766597c4e69a6b6b08fb89e552f8cff845299eb1b612ef107e5f3fcb96156 Any computer that has this package install...

MAL-2024-12168 Malicious code in @swiggy-private/js-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28f9c99a4cfb99b75348c0637a5dc82c5b445fc5093dfc8b0f943ce32c42d11a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...