Malicious code in maximumsats-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6163cb4abd0ceee120100e4ce84e0e12bff00348ee3b55ad338d7d1d3adca47d lib/report.js gathers the developer's email queried via gh api user/emails, git config user.email, /.gitconfig, npm config, and environment variables...

MAL-2026-11486 Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...

MAL-2026-11480 Malicious code in routerbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f468779704fb38dd80ed26eabb01f4afdfef486ebb645d99fc07c36dcb479cf The package published as 'routerbase-mcp' declares a bin named 'install-email-research' and ships lib/report.js which collects the installer's email...

MAL-2026-11463 Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8634bdafa282ed99ee4b3edd205599207ac2f52a4d150d4bdd0f9b69326f64d lib/report.js in [email protected] collects installer-side data using node's os, childprocess, and fs modules os.hostname, os.userInfo,...

Malicious code in rollup-plugin-polyfill-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...

Malicious code in @0xlr/dep-confusion-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...

MAL-2026-11496 Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee541a67169360e2d9ac3da7d19353031dd395c5e1bbe05bb4540ccc4837fa3 The package's exported getPlugin/setPlugin functions, when invoked by a consumer, decode base64-obfuscated string constants svgValidateKey,...

Exploit for Improper Authorization in Microsoft

CVE-2026-54121-CertiGhost This POC is the original POC code f...

Malicious code in @peptide-packets/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0bc181dc4391ee3b974bfa8ec4aafcf982c6bae5f7d9e6850d03d25293cca6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11242 Malicious code in asdsafsafdasdsaasdasda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25b27c7f8bc01a49e1e5d70500418776736b948710b1f4c5bb91b3265957d46d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in moontose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d8d632d57584e0320f3bc47ad4d13768be553c24a711c602e7c865be17a614 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11241 Malicious code in asdsafsadad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67f3884787706e55b04fcf9ab0749dd3f91bd1f8a9d06bd86180483dd9f581cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11344 Malicious code in passsport1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68604126507bac849b697119200b6ef37f408aaa077f208ae0127605159a9832 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2026-17711

Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

MAL-2026-11372 Malicious code in rlp.git (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 684e2df8545256deec1b035965a2f37977d95033aef05d1ad736577d91a04bed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6432be2aefc6715127bc533a383c361b15420316f144dccfc98f1dd4c7d36f06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11300 Malicious code in ethersss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49d76a2dab802ae6aee4310b7efc5a0862c1964a024e7df701cd99741a033797 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers-io-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d93060f754bea6c9c2c5722e253ef9599335702d72a39effe29b2b7668937dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a69deb9966efa1f01057d9db1ed238faa6dcea2b8c35c6047b306e4f33baa9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-bubble (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 956b35c3b022736d505e63ff195d09af3bfe315d35774c9544de2e3569affab8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...