MAL-2026-6849 Malicious code in log-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f55c4d43e953e16c7d0325948c789e0fdf1acefaca4b47ceabf199a5288e6f82 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6836 Malicious code in eslint-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14896c6402e739a2a63d840aef7a65a169ba110c11a9498b42a6bf68278f73e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6818 Malicious code in env-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d885afbe55405d7c329ba1537aae51888c8aa9145f34ab7fdca23ca0abc0a11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6804 Malicious code in bigint.os (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b9150908680087aff7c23e7b04f23a31a7ed89d76047327d7a34d068fd0369e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6744 Malicious code in api-ts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 641c2e8873a175e838cb215cabf680efdb6514c526d920992781fd16201b3adb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6740 Malicious code in decode-sdks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 645d703f4bbd5a7aedaa60a60b7d20af253d4da8efaf82cbac3520a8f21d67b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6726 Malicious code in db-convertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7480b95a12688a84f3efd3d4c5c8a82c5c761f1f462eb22201f4385fb9bf691c index.js defines a method queryDBConnect on the exported DivbloxDatabaseConnector class that base64-decodes a hardcoded constant HASHKEY to the URL...

Malicious code in db-convertor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7480b95a12688a84f3efd3d4c5c8a82c5c761f1f462eb22201f4385fb9bf691c index.js defines a method queryDBConnect on the exported DivbloxDatabaseConnector class that base64-decodes a hardcoded constant HASHKEY to the URL...

MAL-2026-6725 Malicious code in @modhamanish/rn-mm-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bafa948cdfb9fda0d33e923e0e352a384adecfaaab1ece9a20b1b645c1b58ae6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in rs-biginteger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 796cb1ee4c8398963dcc192d2fc9b425866f40f7a99b467cba1d160234508617 Package presents itself as a big-integer arithmetic library and ships the verbatim big.js v7.0.1 source plus its README. Injected between the P.minus...

MAL-2026-6676 Malicious code in terminal-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c7e821d2559361693f75e32b42a5e7a0eef5d99c723d0e35b06f12fd91e9600 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6652 Malicious code in @webda-infra-ui/static-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24e3a5a5b3cabd78201cf327847094e9dab8bfcee7452d7665151ea8ddc75d93 No suspicious behaviors were identified in this package version. The tarball contains 2 files with no lifecycle scripts, no network calls, no...

Malicious code in @contentprod-authoring/block-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa028931eef026447363bc2ef44ace207f4f3226de4289e354d26d730fa28186 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6609 Malicious code in @contentprod-authoring/block-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa028931eef026447363bc2ef44ace207f4f3226de4289e354d26d730fa28186 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6649 Malicious code in @sixt-payment/form-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d313848c4f3389f9778f070aa4c9a198c6cc7e5eb4b9a56b3d3d7cf87569d3c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6626 Malicious code in @hg-aka-prml/tapas-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0283140e8754f9cdc894794ae19307cf6235508d8f8cc75d97b900c1469d9393 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cxp-shared/string-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2cd735ed6a2711ca0dfcb8cb4fee948afe5e923d6b56743b3fd7ee922bd8d14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6629 Malicious code in @lexisnexisrisk/insider-threat-platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dae189d0977c5458ccfe6ac903cf5014acf0e73277c22ad68edf683813066398 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gallup/pc-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eca755b4cbe794ce9b1389cff974fb13df6325eeb2eb658ca64a7bb7ee734b8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6627 Malicious code in @huobi-ui/activity-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2dc07679f0c801fbb465a2502687e29ed687871964c5d84c0dd5f2b7f94e8ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...