Malicious code in safe-validate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7501c4aac0734efb1103573bfcd7e85fa6bb251510656c94bc9ceb747c009d2 The package advertises itself as a zero-dependency TypeScript validation library, but lib/index.js unconditionally requires lib/schema/bootstrap.js a...

MAL-2026-6870 Malicious code in react-svg-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dfd17f5adea1f08d99a1ef6b9cbc94e51b0fa5b67f2fa1971119acf10e3eece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polymarket-onchain-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 718b7995129eb1a8723f77a2c24288aa0160db9903f33468a29a11ec3af29d1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6864 Malicious code in polymarket-onchain-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 718b7995129eb1a8723f77a2c24288aa0160db9903f33468a29a11ec3af29d1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polymarket-onchain-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73556a574d8ee416a5440f889b73cafff3b464650d6b2b2caf4001ce15086f6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6862 Malicious code in pino-pretty-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7864fcfe92b62b2ddc003e696cbe02d18e0979f4336bff4cc9352f318b260fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6861 Malicious code in picocolor-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d3e751383a2838104b1052c4c7fd53fbbaa7205213e84939304080212ea64b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6843 Malicious code in lint-builds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e59bcbbdb88e5ffa12155537c268d8b8a50d9cfd88a462fe9219289e8226b772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6859 Malicious code in older_morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44340068d23f1fff8b2fb707922053997b84f75575607966ba888f15feafbd8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6857 Malicious code in npm-doc-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd9478699eb0ff355280d938bef68818018c0c5cb579b3c144f6c0e134dfad1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in df-vision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f31f7bc1ea70d57f022adc0005cee3e7e6190a458d9bc57a84b1c2966979db7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6833 Malicious code in debug-glitzs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf37ed7b52735892c92547fa8c68a98252eda2db46870cf5066002a2a4670df6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in next-bignumber.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615f1e472f3fec95854738e64a4e4883676d514db833ca3bfa7a1008c0253a57 Package impersonates the widely-used bn.js crypto library: README, repository URL, logo, and source files are copied verbatim from indutny/bn.js, but...

MAL-2026-6847 Malicious code in linter-entry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dd46817b425ee73f1443401b7abcea1d2073f392c91f1af29974ac07a4fe20e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6829 Malicious code in chalki-pretty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 173274fae31c8d400a0fdf965a9cdbf315d2d88e626b554a86d047015ec980d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in metrica-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a0ee3435b3bf0949e63f6770b91c6bb1e2d7912054dc1cb9382e3eae20c84ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6852 Malicious code in metrica-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a0ee3435b3bf0949e63f6770b91c6bb1e2d7912054dc1cb9382e3eae20c84ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6828 Malicious code in chalk-pro-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca82107c7a94834e0b1631156fa6a49bd3eb3e4c5134dc6f89692e0e4739ad39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6840 Malicious code in js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e9d44c332336a14caee5760aaa5452348e99ccefb9c853091186194c1378a68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in log-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f55c4d43e953e16c7d0325948c789e0fdf1acefaca4b47ceabf199a5288e6f82 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...