MAL-2026-6799 Malicious code in awesome-cli-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8126f65c2eaf406ae6c6510e03e8bbef8f243974be621b7e38a0c52d9e521a18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rollup-plugin-polyfill-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcd05581537eece4993579cb664215a82b87dad2bdb03cae7ba998ba092a79d Package name mimics the rollup-plugin- ecosystem but exposes no Rollup plugin API. Its exported functions getPlugin, setPlugin, and getPluginExten ea...

MAL-2026-6826 Malicious code in rollup-plugin-polyfill-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcd05581537eece4993579cb664215a82b87dad2bdb03cae7ba998ba092a79d Package name mimics the rollup-plugin- ecosystem but exposes no Rollup plugin API. Its exported functions getPlugin, setPlugin, and getPluginExten ea...

Malicious code in react-next-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e7369fd2dd1ba9002d2c693ba08c553c7c6fef54dba372146c11f20b43607aa react-next-dom masquerades as a React/Next.js ecosystem package but ships a pino-like surface concealing a remote code loader. The main export is a...

MAL-2026-6825 Malicious code in react-next-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e7369fd2dd1ba9002d2c693ba08c553c7c6fef54dba372146c11f20b43607aa react-next-dom masquerades as a React/Next.js ecosystem package but ships a pino-like surface concealing a remote code loader. The main export is a...

MAL-2026-6797 Malicious code in mongoose-lean-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 540ace1cb8bc936ea953554a9ffc28203370f82cb5e5a7dfbf1454bf0e834b9a On require'mongoose-lean-hooks', the package's main entry index.js runs a top-level async IIFE that issues an HTTP GET to...

Malicious code in mongoose-lean-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 540ace1cb8bc936ea953554a9ffc28203370f82cb5e5a7dfbf1454bf0e834b9a On require'mongoose-lean-hooks', the package's main entry index.js runs a top-level async IIFE that issues an HTTP GET to...

MAL-2026-6793 Malicious code in neon-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe8b090e304f95042a17db9e22edef03d8cdd073a214806e8aa3ebe7b2d138f9 neon-terminal advertises itself as an ANSI color helper but its CJS entry dist/index.cjs and ESM entry src/index.js each execute a shell command at t...

Malicious code in pinokio-redis (npm)

pinokio-redis is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign Wave 4. It was published by npm account 'donimique' [email protected]. The package.json description 'Node.js integration layer for Autodesk Forge' and the bundled README.md literally...

Malicious code in zredis-typed (npm)

zredis-typed is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign Wave 4. It was published by npm account 'donimique' [email protected]. The package.json description 'Node.js integration layer for Autodesk Forge' and the bundled README.md literally...

MAL-2026-6938 Malicious code in pinokio-redis (npm)

pinokio-redis is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign Wave 4. It was published by npm account 'donimique' [email protected]. The package.json description 'Node.js integration layer for Autodesk Forge' and the bundled README.md literally...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

CVE-2025-71366 picklescan - Arbitrary Code Execution via torch.utils.bottleneck.__main__.run_cprofile

picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.main.runcprofile function calls in pickle files, allowing attackers to bypass safety checks. Remote attackers can embed undetected code in pickle files to achieve arbitrary code execution when victims load the files...

CVE-2025-71347

The vulnerability concerns picklescan prior to 0.0.33, which fails to detect malicious pickle files that rely on numpy.f2py.crackfortran.param_eval in reduce methods. This allows remote attackers to embed code that executes during deserialization in applications that load untrusted pickle data, e...

PT-2026-55676

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.28 Description The software fails to detect malicious function calls to torch.utils.bottleneck. main .run cprofile within pickle files. This flaw allows remote attackers to bypass safety checks by embedding...

MAL-2026-6753 Malicious code in schemavault (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae0aa9efa2a8389cfe9d5c41d5ab3689f4965c945a24613493f94f9de033ab1 schemavault 4.1.0 is presented as a schema-validation library but ships capabilities and data that have no relationship to schema validation...

MAL-2026-6790 Malicious code in debugcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff9ad8188112d91f0ea673971f4421ca96dc7943ba12d65c7339c1aa75c2226e The package name debugcli shadows the popular debug package, and index.js is a thin re-export module.exports = require'debug' so callers observe...

MAL-2026-6747 Malicious code in web-api-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ca2f8dce9e845346901818eadd06a0cda318c99ac3e059cd076d9f4065e2c17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6746 Malicious code in typescript-util-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a6bd9cf4dfc55c5c01859852cf26435e42d4b846384d08b80b7d609b27ad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in typescript-util-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a6bd9cf4dfc55c5c01859852cf26435e42d4b846384d08b80b7d609b27ad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...