Malicious code in uudi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdb12754a69bd912f7d51fb243c65d7c681cc0e15a17b561e0a491dd49dbb095 The package uudi was found to contain malicious code. Source: ghsa-malware f7b138cbc39567b6578a6cd48c9b8c7384a2bf7623d0d4542c9e37a1960b329b Any...

MAL-2026-969 Malicious code in scan-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30789e67692889309fe10b2d66e73649dfffbf9644ad1d11175b74334e5473c The package scan-store was found to contain malicious code. Source: ghsa-malware ebbe0d7aca9839086433d668a6b236303aa5f4c8be102ffbb7ffc9a8d73ad79c Any...

Malicious code in yarsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c2ed8a6379e9f5833efbabb80221cc55ce3456a95d14c77ede9ab581bd8f577 The package yarsg was found to contain malicious code. Source: ghsa-malware 71a7932af2640f624c7daef39143653ecaa9d843bda52f61c22687210fc9961d Any...

Malicious code in ethres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba3cafe0e65ebbd1b4bdd577f7277b921eb7e3cf52e5fb46d8e6f6f34b2debd5 The package ethres was found to contain malicious code. Source: ghsa-malware 10924cf4fae0e118a99b95cf45376a7f42ff743f1e8830e78e801c473e0ddd88 Any...

MAL-2026-973 Malicious code in veim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31b89b91cb42611b74a7be2b2f6da42d03473a69e463276f87761d0ede8c71c The package veim was found to contain malicious code. Source: ghsa-malware e9f54d28eecf643750d870dc5e02deec7b66e42cdc998c589c6de0e58341bc47 Any...

Malicious code in veim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31b89b91cb42611b74a7be2b2f6da42d03473a69e463276f87761d0ede8c71c The package veim was found to contain malicious code. Source: ghsa-malware e9f54d28eecf643750d870dc5e02deec7b66e42cdc998c589c6de0e58341bc47 Any...

MAL-2026-958 Malicious code in ethres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba3cafe0e65ebbd1b4bdd577f7277b921eb7e3cf52e5fb46d8e6f6f34b2debd5 The package ethres was found to contain malicious code. Source: ghsa-malware 10924cf4fae0e118a99b95cf45376a7f42ff743f1e8830e78e801c473e0ddd88 Any...

MAL-2026-974 Malicious code in yarsg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c2ed8a6379e9f5833efbabb80221cc55ce3456a95d14c77ede9ab581bd8f577 The package yarsg was found to contain malicious code. Source: ghsa-malware 71a7932af2640f624c7daef39143653ecaa9d843bda52f61c22687210fc9961d Any...

MAL-2026-968 Malicious code in rimarf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa2b9a60774917db6a41edfa73a6fd3857866642eb502367b1d1551d9a1bc0f3 The package rimarf was found to contain malicious code. Source: ghsa-malware a34f8c6537be93ad97761160da11ce153ecb0e128aa76add4d2c46671c4de0c1 Any...

MAL-2026-959 Malicious code in format-defaults (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f00cab7061e49ab4c27f149d8944dbf016be470f0a6380b58d1432ce3c5dfd04 The package format-defaults was found to contain malicious code. Source: ghsa-malware 90aea488bdca1dafac7912501be1bdfb01e2304e4a110715802f98994f2c712...

Malicious code in rimarf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa2b9a60774917db6a41edfa73a6fd3857866642eb502367b1d1551d9a1bc0f3 The package rimarf was found to contain malicious code. Source: ghsa-malware a34f8c6537be93ad97761160da11ce153ecb0e128aa76add4d2c46671c4de0c1 Any...

Malicious code in secp256 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5474e89cc8b0f2d2e5c37d3a2bad92455e82535d614d82fb0ff96979ba1ac2d3 The package secp256 was found to contain malicious code. Source: ghsa-malware 12775af1dc40ed0560ed3a8265ad9a1c9a122b3860a9f081e190b2ad8f30ba5d Any...

MAL-2026-961 Malicious code in iru-caches (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bedff4313b653182b12500ff93779e0605bbd045470b58245a0ab47629e3404f The package iru-caches was found to contain malicious code. Source: ghsa-malware 2f24ac88d53abde060c0a707ee445377609019c4e9f93e40218672b204cb50ff Any...

Malicious code in iruchache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89a5662924927fa4f51ea9338e9e71722d8554754b9c6a42d20651fbf209ed1 The package iruchache was found to contain malicious code. Source: ghsa-malware b44470c4008c04639889f53b9b4ab430335013659859007be3c55f551d2d68a9 Any...

Malicious code in opencraw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaed661cc51e76234fc6cba7587b973903e00bbacd33da7114aeb726d957b577 The package opencraw was found to contain malicious code. Source: ghsa-malware 5bc39adf3939792f918a50cbc9a9952a11d950e361d83d5631449f20ad634945 Any...

Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems

In yet another software supply chain attack, the open-source, artificial intelligence AI-powered coding assistant Cline CLI was updated to stealthily install OpenClaw, a self-hosted autonomous AI agent that has become exceedingly popular in the past few months. "On February 17, 2026, at 3:26 AM P...

ClickFix Campaign Abuses Compromised Sites to Deploy MIMICRAT Malware

Cybersecurity researchers have disclosed details of a new ClickFix campaign that abuses compromised legitimate sites to deliver a previously undocumented remote access trojan RAT called MIMICRAT aka AstarionRAT. "The campaign demonstrates a high level of operational sophistication: compromised...

GHSA-9PPG-JX86-FQW7 Unauthorized npm publish of [email protected] with modified postinstall script

Description On February 17, 2026 at 3:26 AM PT, an unauthorized party used a compromised npm publish token to publish an update to Cline CLI on the NPM registry: [email protected]. The published package contains a modified package.json with an added postinstall script: "postinstall": "npm install -g...

Exploit for CVE-1999-0368

🛡️ Advanced Penetration Testing & System Forensic Audit Mid...

Malicious Package

Overview cline is a malicious package. NPM publishing token for this package was compromised and useb by an unauthorized party to publish version 2.3.0 containing a modified package.json with an added postinstall script "postinstall": "npm install -g openclaw@latest". This causes openclaw an...