MAL-2025-5982 Malicious code in datadog-instrumentations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbf74efed2b32abd010705d5410e78270b572065e8fc02c3a1961b4afc2585ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6085 Malicious code in cwttools1 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-5981 Malicious code in @hub-la/payments-proto (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 788034b39545c288d45be9fa12e76155c224c8537b86eed7b0aaf0cf4e501908 The OpenSSF Package Analysis project identified...

MAL-2025-6138 Malicious code in yxt-open-data (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6097 Malicious code in ifood-companies-manager-front (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15ff1c7dff3bb9bf0f761e0612c87dbda8b646612dca128f9c0471d88b6d6f77 Any computer that has this package installed or running should be considered...

MAL-2025-6205 Malicious code in catalyst_lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1ee883362bf9a21011ce24488ebc14e49484e96df4f64359e2b863ea0cd21a79 The OpenSSF Package Analysis project identified 'catalystlib' @ 9.7.2 npm as malicious. It is considered malicious because: - The package execut...

MAL-2025-6086 Malicious code in date-fns-2 (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5849 Malicious code in ringcentral-google-drive-notification-add-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afbe2fb4071ec030a6a51319f5f0b9d45664bf8caba681cfac58bb60bd001cf0 The OpenSSF Package Analysis project identified 'ringcentral-google-drive-notification-add-in' @ 2.2.2 npm as malicious. It is considered...

MAL-2025-5847 Malicious code in vtk-osmesa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 910e787804512eabe1c118f5347fed9f57ca936717e18a80d26622108d75399e During the installation, sensitive information are exfiltrated incl. env variables --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2025-5846 Malicious code in yandex-metrica (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c347c0cd149f59328faebe4ea3eaf82b02f9eeb1971ee50b89880ccff4620e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5845 Malicious code in workspace-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6337f633e71ac4bbdd2541a6ff172f67246451a691838940e3578c7c7ba4ee18 The OpenSSF Package Analysis project identified 'workspace-loader' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6106 Malicious code in ngf-attachments-list (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6210 Malicious code in mgz-testpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c82f0658f0d08613ec76f5066bad323001a5a95afc35b8befc4a34c82a68e0a7 The OpenSSF Package Analysis project identified 'mgz-testpkg' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2025-5844 Malicious code in ngf-gov-hr-navbar (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 85f2baa5c5673490af93199349e0ef54f7c581115b1fa83d6df2c9e18430e031 The OpenSSF Package Analysis project identified 'ngf-gov-hr-navbar' @...

MAL-2025-5843 Malicious code in ngf-attachment-item-view (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2862be0c2ae4ba5cbde25d09e095fa5b52216a185072b7f27f26052224b2241c The OpenSSF Package Analysis project identified...

AI 'Nudify' Websites Are Raking in Millions of Dollars

Millions of people are accessing harmful AI “nudify” websites. New analysis says the sites are making millions and rely on tech from US companies...

MAL-2025-6029 Malicious code in @isfront/locale (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a70aa8c59bc393d5df205527b22e5db54e16ea4c7e36278003fdce1ab03b9c0e The OpenSSF Package Analysis project identified '@isfront/locale' @...

MAL-2025-6211 Malicious code in mgzfakee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 90b2e8527746aae303a816c6d654f3c6b1d2898ac267657a6fb553577cb0fd0e The OpenSSF Package Analysis project identified 'mgzfakee' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6206 Malicious code in igshared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42c9fa002fd890335fcbf32309ed3d7d078d7ccffd8b3da6c1e2836b5f522db8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6207 Malicious code in lscommons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0f574fcf984262d226cc642d115840f6dc7f8125d0e7eb498928e341cf50cd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...