MAL-2025-1412 Malicious code in electron-dependency-confusion-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db478dbbcf0f5373a70e3193cc1c658b4438bdcd02a3f432b141e442e7bbbda7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1375 Malicious code in pmmmwh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61153050710afa63f182defea4220d45b2a3d6a8aaf0c059d892d9deee856b6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in biconomy-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ccacc09681a6383aa261381df93b651a806293270c031081ae4af8f993652c7 Any computer that has this package install...

Malicious code in crypto-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a037816e38bab1c99484a360227650688ef0859f5e52d151d3b2c87a0865535 Any computer that has this package install...

Malicious code in bingx-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5d8cdbe3e0f835d014b61ec4d6c06b7b62a9ac36231e8ff2488cd4ce4fbe0ca Any computer that has this package install...

Malicious code in tree-sitter-sqlite (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6171aef6bf33d3a77ea0523c0609d12e396a579ce197757f9ac020689a6c2363 Any computer that has this package installed or running should be considered...

Malicious code in @devstack-angular/jdai (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac06a10b7b09cb556a876d7b76ede19361cf8c7fb2b92fe70daf3f55cc180dd2 Any computer that has this package installed or running should be considered...

MAL-2025-1060 Malicious code in alpha-launcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813103e220bbdc9611499386ec8ea80516980d09eeca43e74370925dc5f3a387 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1132 Malicious code in hire-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c290018cf38e83059255d39fb3be4583fdc5dafbdc157034cda22edd1c80893 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1102 Malicious code in csvue-unplugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 409257b16103ee7b420a285630aeb8985fe42d7e0ef833aeeed9c03d9539f620 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1100 Malicious code in csmagnifier-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a41b68567cf24680e7cbca7353ab826a7c2aaf25438fa38f0d0187d61d34d0bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1080 Malicious code in core-exchange-spec (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25841b252b02710b4266777e5590f4848c43a4cef55f97355283e0db4fed64d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auto-claim-service (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efa2e8f48f3db602101174a240d4b1f09b07e239bfb6fb4770cbd0cacd44583b Any computer that has this package installed or running should be considered...

MAL-2025-571 Malicious code in ebay-testeru (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10bc1dcc6bd74446e082ab66f1aa06c7ad778cd162497ed913f8b9678c4068b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-329 Malicious code in ai-plugin-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 375f6ac1b62a76dd86681b0fc33bfe8a4162eb0ff032e0d0c96e5bb8735d7953 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-332 Malicious code in charjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30d644c2eb731d4dcad0bf39f80c41f09bddda4c07d8d2e90ce7a1e1b55716ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-289 Malicious code in custom-colors-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 032f8182b803592f8c4bcf04cdc223b43ac526a86a9e8a273bcc8177682b96f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-317 Malicious code in viewport-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 267002a03c6d919765b3d26bea4ac822e509a4829c59b075764cecf051da4722 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babel-plugin-i18n-calypso (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5be90c4dbcb38fbd7461004561537640adcf0ee532efbe124872f5f11ebd82b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in showcase-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72fdeda4a40b1170fc3888255d22ac1cb9cfe37834663d8a5812539c21e7c8e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...