MAL-2026-15840 Malicious code in google-cloud-internal-core-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 655e243795a73e8b8b7f7b1c9b4f5769d1d13deba1dc53679fe6153b8405a531 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15841 Malicious code in google-cloud-mono-repo-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6a8a52a13a2bca203b074422db3b908a9b961e1b849a86734a6a2a38f9504a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15827 Malicious code in company-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud...

Malicious code in company-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud...

MAL-2026-15828 Malicious code in env-validator-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964 The package ships no source module only egg-info metadata despite declaring a consolescript entrypoint 'env-validator=envvalidator.cli:main' that...

MAL-2026-15829 Malicious code in telemetry-helper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26ef1779c00c37e2ee65632fefde6bbe242f5a15294ee018caa1d1d2ad5b6000 On import telemetryhelper, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname,...

CVE-2026-9852: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue...

MAL-2026-16010 Malicious code in AzureCdnInfo.edrtester (VSCode)

The Visual Studio Code Marketplace extension AzureCdnInfo.edrtester version 1.0.4 presents as an EDR/telemetry test utility but is a beaconing backdoor. On activation, extension.js loads edrdrill.js, which performs host reconnaissance — hostname, current working directory and local IP — and...

Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

MAL-2026-15825 Malicious code in real-router-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91fd520ae94997277ef7d591d30dc728b895611fd45b890e2ec1a68233e29a8 package.json declares a preinstall script that runs an inline node command reading the installer's OS hostname, username, and current working directo...

Malicious code in bambang-kripik74-riris (npm)

Source: amazon-inspector afad37b2c72b6dc40e4697866a2e90d084124b5c06d89e9b274d2871d16e08c2 The package bambang-kripik74-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

MAL-2026-15844 Malicious code in onceaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52acfee73c36f7df40ac54204cef235483203b7dec9208d5b219cb7068d341f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in is-generator-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93931fecef2da94abf1de73e282da2c510715512d61bfe8afd1197925f4b6e08 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15843 Malicious code in is-generator-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93931fecef2da94abf1de73e282da2c510715512d61bfe8afd1197925f4b6e08 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in daisypick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9bd46c99a0d58d9ded0faca080e42efa9015c9bd213c46292e82644117d53ae The package presents itself as a Tailwind CSS color/service-worker helper, but the daisypick/plugin export reads a URL from...

MAL-2026-15835 Malicious code in daisypick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9bd46c99a0d58d9ded0faca080e42efa9015c9bd213c46292e82644117d53ae The package presents itself as a Tailwind CSS color/service-worker helper, but the daisypick/plugin export reads a URL from...

Malicious Package

Overview aril-47 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...