MAL-2026-3202 Malicious code in eslint-plugin-skyscanner-dates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fa3152c92c23ebec42990f14c77642de971e5a5464b0e7c25ecdea012ac81e4 The package eslint-plugin-skyscanner-dates was found to contain malicious code. Source: ghsa-malware...

Malicious code in sirens-lament (npm)

Four pirate-themed npm packages blackbeards-navigator, beusy, sirens-lament, gunpowder-ghost were published by the npm account beusy with heavily inflated version numbers 209.0.0–210.0.0, a hallmark of dependency confusion attacks. Each package contains identical malicious lifecycle scripts...

Malicious code in ac-sasskit-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f511f3bd2772e3721f69519323ae4557eb447a809eef469c46a1c500fe96c1c0 The package ac-sasskit-beta was found to contain malicious code. Source: ghsa-malware 1873c549998c97b796fea0e8381c73ed62d3517f9eac35919b3225ad2a2f454...

Malicious code in apple-appstore-full-library-utility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c81abc0b0ca85dceebddbddb78e6e2d6d05f87331f11b9a1190ad29d10adb4a The package apple-appstore-full-library-utility was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3140 Malicious code in fivem-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a604a0acf84f672e7a3235e103f365f9d9f704c96faa12dcb5b9b0a9806004 The package fivem-monitor was found to contain malicious code. Source: ghsa-malware bea91e9a2c853e88f029684fb53cecc15f1960b1ccafb583b1da52a754f9ee4d...

MAL-2026-3129 Malicious code in supertag (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8af13a06fb931a42d83e13b19fd998ff62e59ef3d56302bfe9d257e07e2bad46 The OpenSSF Package Analysis project identified 'supertag' @ 99.1.1 crates.io as malicious. It is considered malicious because: - The package...

Malicious code in coloreasyprint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d52af876a91a6ff5ff8144b705201fd465db94ad89f0e1b37bd22fe6ca0f5622 During import, the code downloads and executes encrypted payload from remote location. During analysis, remote code was prepared to download the next stage...

Malicious code in lsh (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8cd6cecd3051e3998c5f96ec8dbe1bcfffc1ed7133d394a1779c8c1b0252c8c0 The OpenSSF Package Analysis project identified 'lsh' @ 99.0.1 crates.io as malicious. It is considered malicious because: - The package...

MAL-2026-3126 Malicious code in lsh (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8cd6cecd3051e3998c5f96ec8dbe1bcfffc1ed7133d394a1779c8c1b0252c8c0 The OpenSSF Package Analysis project identified 'lsh' @ 99.0.1 crates.io as malicious. It is considered malicious because: - The package...

Malicious code in apple-app-store-server-library-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6b57befbd248b884d81978566bd3d4a57ef499f1eb8f8f66c00dc02e76588c The package apple-app-store-server-library-poc was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3103 Malicious code in amzn_codewhisperer_streaming_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7fc27be867bc1ae651b345d2f825d0ac8d796615c022747306e87bd3ff0d1fc8 The OpenSSF Package Analysis project identified 'amzn-codewhisperer-streaming-client' @ 99.0.1 crates.io as malicious. It is considered maliciou...

MAL-2026-3120 Malicious code in @pyme-web/web-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e52ac4b8d97b81cff5824f4ddc38897183df4e20ecd3f1e7df62e8f6645f236a The package @pyme-web/web-api was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3119 Malicious code in @pyme-web/ui-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a73f6d1f150b07a8023fdef84fc4cc091a7cecbed37ff3364bfb328747951526 The package @pyme-web/ui-widget was found to contain malicious code. Source: ghsa-malware...

Malicious code in @pyme-web/ui-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a73f6d1f150b07a8023fdef84fc4cc091a7cecbed37ff3364bfb328747951526 The package @pyme-web/ui-widget was found to contain malicious code. Source: ghsa-malware...

Malicious code in amzn_consolas_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b994a8876bfb6c3da65e5f20b8cd611ebbb87995fa052e2f6283b5c09bfb0a91 The OpenSSF Package Analysis project identified 'amzn-consolas-client' @ 99.0.1 crates.io as malicious. It is considered malicious because: - Th...

MAL-2026-3101 Malicious code in amzn_consolas_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b994a8876bfb6c3da65e5f20b8cd611ebbb87995fa052e2f6283b5c09bfb0a91 The OpenSSF Package Analysis project identified 'amzn-consolas-client' @ 99.0.1 crates.io as malicious. It is considered malicious because: - Th...

MAL-2026-3102 Malicious code in semantic_search_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2495e4537e60cafc5bc13f96987b82749fce367078ee036e3e4fb4421b5bdf4c The OpenSSF Package Analysis project identified 'semantic-search-client' @ 99.0.1 crates.io as malicious. It is considered malicious because: -...

Malicious code in semantic_search_client (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2495e4537e60cafc5bc13f96987b82749fce367078ee036e3e4fb4421b5bdf4c The OpenSSF Package Analysis project identified 'semantic-search-client' @ 99.0.1 crates.io as malicious. It is considered malicious because: -...

MAL-2026-3121 Malicious code in @taxmoninor/taxmon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42f9358f8af80b7021c6d4bb86f10796de5ad8ef2ec941d0057954b9e6a18355 The package @taxmoninor/taxmon was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3108 Malicious code in @activation_code/success (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d00bacff8cfa3ae8a22cfb51c4be0ad025ce42bc29929c07a7eaad6be36c702c The package @activationcode/success was found to contain malicious code. Source: ghsa-malware...