MAL-2026-11025 Malicious code in da-sc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 529aa128042d1720778ad1affadb1568f6bf39839a2874682db8d2f55a3b15f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11022 Malicious code in aio-commerce-lib-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9479591a21dd21e28dbd04aaf239e1da57eae40a248247d8e270d8e6f1278fdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11028 Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88a382e4c69ff8c5502f735bad1d59e7ea76ef65c55921193fbce8bdac5f4d7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11023 Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e251130fcb84c2b20ede3b09d95f501bd3b593c051cf0f95d6beba9b11949a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11026 Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11021 Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11020 Malicious code in hardhat-gas-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f908ec767bb48d5cf889b1035fc89ff03d0422bfa043e3c361c4faf0002df95 On module load, the package schedules a randomized 5-15 second setTimeout that POSTs a JSON body containing os.hostname, os.userInfo.username,...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11011 Malicious code in encrypt-string-ttak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf72c81030b9346ff3d3dd6f2e5f3395a61d433def25e5e2ea2a7e52a6051999 The package is published as a UniApp 'encryptString' helper but its single shipped module dist/encrypt-string.js is heavily obfuscated obfuscator.io...

MAL-2026-11004 Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...

MAL-2026-10997 Malicious code in n8n-nodes-http-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af index.js executes a top-level IIFE on module load that 1 spawns /bin/bash wired to a TCP socket connecting to 103.27.109.184:8895, giving the attacke...

MAL-2026-10998 Malicious code in n8n-nodes-port-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cffdebe2e0a27deb3751af547baace8a403244cb92d214db726d3700a192d61e index.js executes a top-level IIFE at require-time that 1 runs hostname, hostname -I, id, ip route, ip neigh/arp and reads /etc/resolv.conf, opens a...

MAL-2026-10996 Malicious code in init-js-examples (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6005f6b51f3286b65f92b6c8dd73d51c744f89428bbb238f2186b61b7112e6c2 The package's postinstall lifecycle hook runs setup.js, which opens a TCP socket to the hardcoded remote endpoint 130.61.90.45:4443 and wires the...

MAL-2026-11014 Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5db4f6fb4cd8bc8073e03771776ba865f51f852120bd44162573774905ccf22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11010 Malicious code in calvora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc3f7e9ef1bbc85d0303406eac1b28cace865d65ab2bbad1104ba2f0adaaa78 index.mjs auto-invokes a sync routine at module import. Under Linux with NODEENV!= production and access to a WSL /mnt/c mount, it locates a Windows...

MAL-2026-11009 Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...

Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...

MAL-2026-11018 Malicious code in veldora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2e3a6a16c04af92c19ea149ef526996cdaea7357b931cdbccedffd6237f598e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11016 Malicious code in vantora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 530a2162909707ce34212e910d9a625ad0a4a6a746a7a48f5e3f3523b3b3df23 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...