Malicious Package

Overview gunpowder-ghost is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-37293

Malicious code in gunpowder-ghost-curse npm...

EUVD-2025-37299

Malicious code in @dvargas135/gunpowder-ghost npm...

Malicious code in @dvargas135/gunpowder-ghost (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 400dea6d2b5bfe1ff00f2fe709cb1ef33f393894e93bff155b32021682d1e571 The package @dvargas135/gunpowder-ghost was found to contain malicious code...

Malicious code in gunpowder-ghost-curse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c321a65829e56f1b0a19c8674e57684adb978f6689b380037c41189d68cbfe2 The package gunpowder-ghost-curse was found to contain malicious code...

MAL-2025-49293 Malicious code in @dvargas135/gunpowder-ghost (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 400dea6d2b5bfe1ff00f2fe709cb1ef33f393894e93bff155b32021682d1e571 The package @dvargas135/gunpowder-ghost was found to contain malicious code...

MAL-2025-49299 Malicious code in gunpowder-ghost-curse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c321a65829e56f1b0a19c8674e57684adb978f6689b380037c41189d68cbfe2 The package gunpowder-ghost-curse was found to contain malicious code...

MAL-2025-49286 Malicious code in gunpowder-ghost (npm)

Four pirate-themed npm packages blackbeards-navigator, beusy, sirens-lament, gunpowder-ghost were published by the npm account beusy with heavily inflated version numbers 209.0.0–210.0.0, a hallmark of dependency confusion attacks. Each package contains identical malicious lifecycle scripts...

EUVD-2025-37278

Malicious code in gunpowder-ghost npm...

Malicious code in gunpowder-ghost (npm)

Four pirate-themed npm packages blackbeards-navigator, beusy, sirens-lament, gunpowder-ghost were published by the npm account beusy with heavily inflated version numbers 209.0.0–210.0.0, a hallmark of dependency confusion attacks. Each package contains identical malicious lifecycle scripts...