MAL-2026-6847 Malicious code in linter-entry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dd46817b425ee73f1443401b7abcea1d2073f392c91f1af29974ac07a4fe20e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6829 Malicious code in chalki-pretty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 173274fae31c8d400a0fdf965a9cdbf315d2d88e626b554a86d047015ec980d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6852 Malicious code in metrica-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a0ee3435b3bf0949e63f6770b91c6bb1e2d7912054dc1cb9382e3eae20c84ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in log-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f55c4d43e953e16c7d0325948c789e0fdf1acefaca4b47ceabf199a5288e6f82 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6842 Malicious code in lint-builders (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77e005a8681b02ece13fee77659bccecc2591030c3dbb5681e81dc31fcb25c3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6835 Malicious code in es-lint-entry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7abab05be195342f311825ea394c11273032428d1bd122dd4fe31f8a5b8da554 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6839 Malicious code in hjs-lint-builders (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0fb723c71ef04ac50fb2126b5a4df175698c4c1a8a782536880c7031406e6bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6807 Malicious code in bootstrap-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9ac4913fc1ffcabe1ed6637abc6d532abc014683f48b341ece6127a51da15d8 The package's index.js is heavily obfuscated with classic string-array shuffling patterns e.g., while!! loops with repeated 'shift' calls and...

MAL-2026-6812 Malicious code in cookie-ease (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e657448e95c84051d3c103da0e4bd744f5bc6cbbeedad66099d1ecf4681a65d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in argonflux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac7feeef8f690a4bff32cb47e1725046d4c0ae9a1abdf45ac4b434f59d314320 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6746 Malicious code in typescript-util-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a6bd9cf4dfc55c5c01859852cf26435e42d4b846384d08b80b7d609b27ad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6687 Malicious code in procwire (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011cf28d546459d946b1ed6d92c3beb4cb7c5322d6a9370d52fcd40e9a81ac2f On Windows, installing [email protected] automatically downloads and executes an attacker-controlled executable. The package.json preinstall script runs...

MAL-2026-6605 Malicious code in @bscom/styling (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b4a6eb2b93e7ac0b6e45f2cc44f23127ef61b7d605b6c64f6bcbc58bdbe4543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6606 Malicious code in @concerns/i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b727ee2cbb3fadb59ee0ec7febb6db24f25e775ee3957c6765800a61de44289f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6639 Malicious code in @postman-app-monolith/renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4ea9912817d4d94e8b97e2b588237f3f2cddc29058e81d8958ec78b4b90d961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6611 Malicious code in @cxp-shared/string-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2cd735ed6a2711ca0dfcb8cb4fee948afe5e923d6b56743b3fd7ee922bd8d14 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6634 Malicious code in @multformats/multiaddr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3ff8f79934c43d48f410746d2fe1a9244365c8bac615e7552dcedbfae15b900 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6630 Malicious code in @live-backstage-im/communication-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad217e6f53767b755ad267a2052b4bc35add8ba6cdb6532dfec034c83e3d3426 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6650 Malicious code in @sumoinc/trashpanda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e09b9154d541180251e27c886086d159c5bcfa3be869f0e756801cdbd5a4226 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @grappi/automations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfa70084df92420d9b31f4eb1da3b47bccc78cc677a9f6fb3ac242c857f2e925 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...