Malicious code in siren-lament (npm)

Source: amazon-inspector 66198e889b19f908f338ab5cad00c57bc95194bff8938dcf26c4a853c0b260d8 The package contains two files and declares no lifecycle scripts, remote fetches, credential reads, or network exfiltration paths. Version coordinate 0.0.0-stage and minimal file count are consistent with a...

Malicious code in black-spindle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dd746168a2e733a835005f5fd321e1bab9a24688a4c5d413247ae065ea29786 [email protected] declares a postinstall lifecycle hook in package.json that executes curl http://778e-181-63-25-28.ngrok-free.app/test on every...

Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

Malicious code in lightweight-charts-4.1 (npm)

Source: amazon-inspector 1f7a7bcf5678b42c2da20ad8e444066092ac3a9c17a6c8867a034717d1d8c344 The package lightweight-charts-4.1 was found to contain malicious code. Source: ossf-package-analysis 3bf5f9054bf59235c7406b076fed3f65c71c616f5c6f9a044b320f1376d793e8 The OpenSSF Package Analysis project...

Malicious code in libxmlussr1 (npm)

Source: amazon-inspector 53a26137f4b62749b9f491cb82c0c0f9d95f0fa03f7dcd2e8067b39b5de0e005 The package libxmlussr1 was found to contain malicious code. Source: ossf-package-analysis 08f90af0e1186fb0b75f135e5764cce07fe11f3d68115fe4195d556e7b0171da The OpenSSF Package Analysis project identified...

Malicious code in libxmljs2qwerty (npm)

Source: amazon-inspector 98e288816b28da06174dcb7d9315fb857fc7daf80f81a57de2fbe1b0a3419895 The package libxmljs2qwerty was found to contain malicious code. Source: ossf-package-analysis 2d91988ba951c71566b9b39a2279ab047bd3e9233e58720bf517d55bd2170fee The OpenSSF Package Analysis project identified...

Malicious code in libxmljsololo2 (npm)

Source: amazon-inspector ddf08b4bf0c122f751f82c3c5b909759570d84e47e5059bde5729221ae910a15 The package libxmljsololo2 was found to contain malicious code. Source: ossf-package-analysis e4990f2ad9b80a96f05d335d0d8f89fbe25f5b84b3f3d4c1c9f02b1dea179710 The OpenSSF Package Analysis project identified...

Malicious code in lib-jitsi-meet-sample (npm)

Source: ossf-package-analysis 0247e3f2877ee9dba4689c00ae13db004afaea694957dfb979bf3cfbd1ef9e31 The OpenSSF Package Analysis project identified 'lib-jitsi-meet-sample' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with maliciou...

Malicious code in kss-node-handlebars-builder (npm)

Source: ossf-package-analysis cca63cd37e035f2a065952377f5c8b77ac950f443c2ac3233ead4b6203f62d9c The OpenSSF Package Analysis project identified 'kss-node-handlebars-builder' @ 9.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in knowpro (npm)

Source: ossf-package-analysis 4050d9edab117029be58467368808cdb539f5d3b4dee8741011d5186c7c74766 The OpenSSF Package Analysis project identified 'knowpro' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - Th...

Malicious code in kkkaremn (npm)

Source: amazon-inspector 8be05818c3e6f94f41c611af1a16f1a88489f457de3d8b98cc9c4441eee9e557 The package kkkaremn was found to contain malicious code. Source: ossf-package-analysis 38d12856c4db0126dfe51c098b1f21420abc032d85ddf07e3df4a6e4cb997b17 The OpenSSF Package Analysis project identified...

Malicious code in bender-rspack-config (npm)

Source: ossf-package-analysis 159730c04aeb50c0e832685be81c3f332d8692bf4a9f1a419c7223dbe5059491 The OpenSSF Package Analysis project identified 'bender-rspack-config' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

MAL-2026-16221 Malicious code in bender-rspack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6997cea54ae81d1addcb41ddac29e94923dfa1042265253c555cb4945ad5b4 package.json declares a preinstall lifecycle script that runs wget against a hardcoded webhook.site URL, embedding $whoami, $pwd, and $hostname as...

Malicious code in jitsi-meet-load-test (npm)

Source: ossf-package-analysis 4d8d6095bca0d534688b13d2823e401a9d42de4a2fc1fdc8c9bd1be3b147b746 The OpenSSF Package Analysis project identified 'jitsi-meet-load-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in jenkins-trigger-action (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis fedbad1242e09329c414a95c493ce62c39c15cad4472ef5fc4a8b9b836834fb4 The OpenSSF Package Analysis project identified 'jenkins-trigger-action' @ 10.0.1 npm as malicious. It is considered malicious...

Malicious code in isotopet4s-layout (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis 89341dbe7c72a6b4924313c2697d976b5570b3c9056de1b6ebf35ad41337387d The OpenSSF Package Analysis project identified 'isotopet4s-layout' @ 99.99.1 npm as malicious. It is considered malicious...

Malicious code in invalid-polyfill-boundary (npm)

Source: ossf-package-analysis 0fbf998b1c11f6a785806e2ab4f0bbbc4da9a95e803f643a497d41215484a11d The OpenSSF Package Analysis project identified 'invalid-polyfill-boundary' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in internal-plugin-lifecycle-card (npm)

Source: ossf-package-analysis 332aa89488a5ecb7012588f98648ef97de374565f906dfc69ff80d4d344e9a03 The OpenSSF Package Analysis project identified 'internal-plugin-lifecycle-card' @ 99.9.10 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in internal-test-devoxx (npm)

Source: ossf-package-analysis fb92a072265a550a5ce1cc1d16f096b636845bc8edabaf60bddfebad43c423bd The OpenSSF Package Analysis project identified 'internal-test-devoxx' @ 0.0.4 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in inter-frontend-svgs (npm)

The package communicates with a domain associated with malicious activity. Source: ossf-package-analysis cef0c87cb238b6a66e63b6ede215bd1d867b47ff3bcad84258647d55c810c520 The OpenSSF Package Analysis project identified 'inter-frontend-svgs' @ 999.0.0 npm as malicious. It is considered malicious...