Malicious code in apple-internal-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16ae120f182e305f15d778dfe594aa3f79076b93b5bd4be77f293fdf08c5e12a The package apple-internal-config was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3019 Malicious code in hls.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96d28bd3e78b3ca60b3356380f0d7931659606c2b5def5865480d838ad21a0b3 The package hls.js was found to contain malicious code. Source: ghsa-malware 04b58b7f11fd42610f3056d4bc9aa84804d2ab9e657d7b84771cec1efe363ba9 Any...

K000160944: Axios NPM supply chain attack MAL-2026-2306 GHSA-fw8c-xr5c-95f9

Security Advisory Description Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer ma...

Malicious code in npm-doc-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a8ae6448e13630c5243e98e1794e9b2f57b0e999d4c31687f0db0f1665496f9 The package npm-doc-deploy was found to contain malicious code. Source: ghsa-malware f7938c30cf6da645723648c4c43979c97d7c006933fb24ccab60154f1cc5d084...

Malicious code in chatbotloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78643cb5d37687c0eac0935734bac95f23c01b64ded6bb2f2f090542324042ac The package chatbotloader was found to contain malicious code. Source: ghsa-malware 88ccdb3c34d69b2e53f62caa6b7e61f32e7868fa5893d6fd6d09662189d10b34...

Malicious code in ms-affiliate-links (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341048b16926b4d40796ca96aef3816934a2b84602c26451638154b6d90ab5d8 The package ms-affiliate-links was found to contain malicious code. Source: ghsa-malware...

Malicious code in stats-api-js-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a84f9d7eef71d2b99a244ec63f5144ad80a0084e6c20fc903a1bbce208ad9777 The package stats-api-js-client was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2635 Malicious code in pubnub-element (npm)

Malicious scripts exfiltrate sensitive info username, path, hostname to a remote webhook via wget in test, preinstall & preupdate. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f1f86ef3c85074c2ca23cfd60296a4875f6bc610547f691543cef5f38e1788a The package...

MAL-2026-2617 Malicious code in upstartautoretailadmin (npm)

Package is malware. Collects sensitive info SSH keys, AWS creds, bash history, system info, executes commands, & exfiltrates data to a remote server. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9edbed871d1889b053bc8348b33250ffc9a92979323ecb9133d379e2e3836c2d...

MAL-2026-2248 Malicious code in shop-republik-ch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3fe1a756db5b61e6883fb43ab2f27fd56333e302ad597c4bb9f1743b1f19b6 The package shop-republik-ch was found to contain malicious code. Source: ghsa-malware b68c5977e45306e58eda4d2345cb1ac0eba178c179064471f3327a30915e6d...

Malicious code in validator-lut-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c9f447a3c02a6c7ea716862009fcf6853c8d52e05144fa78746cbdbfe3ef000 The package validator-lut-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2216 Malicious code in @pumpfun-ipfs/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21604418f7961773b23e7b3544ca95874cba1432a87ae6d4127531e651133f78 The package @pumpfun-ipfs/sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2111 Malicious code in tailwind-font-inter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2cb39a969b06dada95f847c6d5fc21fd0cb38a37c6b38a6b60ef1ca439f2147 The package tailwind-font-inter was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2078 Malicious code in @emilgroup/task-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4aef8ca2987206595d5c54a2df6265669bdb67ca99915bb763ac38f2d6a46d7 The package @emilgroup/task-sdk was found to contain malicious code. Source: ghsa-malware...

Malicious code in @emilgroup/setting-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd7001495cf0c7d9cbe60f2b406b90b4fc34d7a8fc8477c45780cefddf26e28b The package @emilgroup/setting-sdk-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in @emilgroup/account-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c31c8b6deb277deb631be4e0ce8b07d6896462492574a9e5b25041a9b0b6424 The package @emilgroup/account-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2031 Malicious code in @emilgroup/account-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c31c8b6deb277deb631be4e0ce8b07d6896462492574a9e5b25041a9b0b6424 The package @emilgroup/account-sdk was found to contain malicious code. Source: ghsa-malware...

Malicious code in kyxserver-everything (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7be104f8e720927f9b7ea1bb3d036db80ffa6b65c8b7f0a6c8af29d1d4631f43 The package kyxserver-everything was found to contain malicious code. Source: ghsa-malware...

Malicious code in polymarket-onchain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2766ecc75c1eebb5fc12c56509494d72472b8b2a8a2c0ebdb296bdfbcc06023d The package polymarket-onchain was found to contain malicious code. Source: ghsa-malware...

Malicious code in jsonify-bundler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aa4b4269de8cd80d5dcc7106a78d477d668896627219a2f6e2199aef68f196f The package jsonify-bundler was found to contain malicious code. Source: ghsa-malware ce66e88fca5eb80c0c46cbfc975ac7fae97a50a6e0c7365cee57762e9a06b99...