Malicious code in cacao1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8 The package has no advertised functionality empty description, self-referential dependency on its own name at ^9.9.9. Its package.json declares both...

Malicious code in yamlformat-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-14589 Malicious code in yamlformat-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-14588 Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

MAL-2026-14586 Malicious code in @fleetbo/svro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d86373813cd4d2b65edb11f6a3f352ad81a55e7de0444884f66b0adb482e661 The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled identifiers 0x56260b, 0x12d64...

Malicious code in @fleetbo/svro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d86373813cd4d2b65edb11f6a3f352ad81a55e7de0444884f66b0adb482e661 The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled identifiers 0x56260b, 0x12d64...

MAL-2026-14585 Malicious code in @znan/wabot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e857d5e68584a6a0b5bde34073d45d16540ddda6d38bf7b3082e49d07bd8b484 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @znan/wabot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e857d5e68584a6a0b5bde34073d45d16540ddda6d38bf7b3082e49d07bd8b484 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

MAL-2026-14578 Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

MAL-2026-14575 Malicious code in @hd-team/app-impkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1337f5939f8a1aab2f4e110aa41afd3b9f6cfe4501319a0ad33de48abf178cc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14571 Malicious code in @hd-team/app-dnpkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8d3c5fba8b00e8f8ebe7868093ff8cbe2b14607b15abad8a711310868d0833e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14574 Malicious code in @hd-team/app-dnpkg-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a881d064bac4343f3b849e3b2e45fa0bb9fb8249f191f85297f53edecf08d96b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529 The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a...

Malicious code in @hd-team/app-dnpkg-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a881d064bac4343f3b849e3b2e45fa0bb9fb8249f191f85297f53edecf08d96b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-impkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1337f5939f8a1aab2f4e110aa41afd3b9f6cfe4501319a0ad33de48abf178cc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-dnpkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8d3c5fba8b00e8f8ebe7868093ff8cbe2b14607b15abad8a711310868d0833e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hd-team/app-impkg-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4a6c7bf61aa8ff219249cee5204bc5fe556e216c34afa39a5ce2685399ffbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14569 Malicious code in @hd-team/app-dnpkg-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529 The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a...