MAL-2026-17878 Malicious code in util-foriepft (npm)

[email protected] was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through childprocess and sends thei...

MAL-2026-17766 Malicious code in @s4yhiitestpoc/scan-https-d (npm)

Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...

Malicious code in @s4yhiitestpoc/scan-https-d (npm)

Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...

Malicious code in @coopeuch/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59 @coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version 1.999.999...

MAL-2026-17760 Malicious code in @coopeuch/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59 @coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version 1.999.999...

MAL-2026-17777 Malicious code in react-paginate-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an...

Malicious code in liferay-workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...

MAL-2026-17772 Malicious code in liferay-workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...

MAL-2026-17770 Malicious code in ksp-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b14a9fbd9fc1a48dc3ac0498f9606cecb1a56bad912c7f8a818fad332ef9ad15 [email protected] is a dependency-confusion-shaped npm package whose only payload is an opaque prebuilt Linux x64 native addon loaded at install...

MAL-2026-17767 Malicious code in another-very-long-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea9e3cf3d973c07d09048435d4ddc496574ce222d650c228b1400d866ea3ccf [email protected] ships a beacon.cjs that is invoked both from the declared postinstall lifecycle script and from the module's require-tim...

MAL-2026-17768 Malicious code in cloudflare_module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242 Package [email protected] is a dependency-confusion lure targeting the cloudflare namespace. package.json declares scripts.postinstall: "node...

Malicious code in @coopeuch/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee1a3bb0818d46a9c83659ed32f8ab209477970658d5f6f8241a12c96d137c98 The package's postinstall lifecycle script postinstall.js runs automatically on npm install and harvests installer host identifiers — hostname,...

MAL-2026-17769 Malicious code in deposit-limit-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89565d767d3541470834dc9764af6e4abbe4acb5ba4eb721f7e3008e3a80b1d2 [email protected] is published as a 'Deposit limit frontend utilities' library but its main entry index.js exports an empty object and shi...

Malicious code in nitro-bundled-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622 The npm package [email protected] presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname,...

MAL-2026-17774 Malicious code in nitro-bundled-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622 The npm package [email protected] presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname,...

tmux

¡Bienvenido a tmux! tmux es un multiplexor de terminales: permite crear, acceder y controlar varios terminales desde una sola pantalla. tmux puede separarse de una pantalla y seguir ejecutándose en segundo plano, y luego volver a conectarse. Esta versión funciona en OpenBSD, FreeBSD, NetBSD, Linu...

ore-mal-pkg-inspector

OreWatch Detección de Paquetes Maliciosos Multi-Ecosistema y Escáner de Seguridad en la Cadena de Suministro Una herramienta de seguridad de grado de producción para detectar paquetes maliciosos y amenazas en la cadena de suministro en los ecosistemas npm, PyPI, Maven, RubyGems, Go y Cargo...

mininode

Mininode Mininode es una herramienta CLI para reducir la superficie de ataque de las aplicaciones Node.js mediante el análisis estático del código fuente. Soporta dos modos de reducción: 1 grueso, 2 fino. Mininode construye el gráfico de dependencias módulos y funciones utilizados de la aplicació...

combobulator

Dependency Combobulator Dependency Combobulator es un framework de código abierto, modular y extensible para detectar y prevenir fugas de confusión de dependencias y posibles ataques. Esto facilita un enfoque holístico para garantizar lanzamientos de aplicaciones seguros que pueden evaluarse fren...

log4j-detector

Log4-detector Escáner que detecta versiones vulnerables de Log4J para ayudar a los equipos a evaluar su exposición a CVE-2021-44228 CRÍTICA, CVE-2021-45046, CVE-2021-45105 y CVE-2021-44832. Puede buscar instancias de Log4J examinando cuidadosamente el sistema de archivos completo, incluyendo toda...