Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 486630eaee2b9eb50d03d73886a14b7249b0c28fda2cb3f6a13565c8cd38a9bb pypi package rak-lab-yoav-orca-zrktd2cp5hjmo4x7 version 9.9.9 ships a setup.py that, during pip install, reads the DEPLOYMENTTOKEN environment variab...

MAL-2026-16240 Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

MAL-2026-16243 Malicious code in idx_form_script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cc222b7d4398590749d82ffc06100ca629c6e07970a0f95bcf63889fda19cd3 [email protected] is published with an implausibly high version number characteristic of dependency-confusion attacks against private internal...

MAL-2026-16222 Malicious code in @traktis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...

Malicious code in @traktis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...

MAL-2026-16224 Malicious code in process-mite (npm)

This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...

Malicious code in discord-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...

MAL-2026-16214 Malicious code in discord-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...

MAL-2026-16213 Malicious code in discord-players (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eadb25768efba4ff9dc9170a838f90f6572993195d37e526543fa956e65faa2 index.js is the package main and unconditionally starts a backup loop at module top level. On require, BackupManager zips process.cwd excluding...

MAL-2026-16220 Malicious code in jexkcode (npm)

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter suppo...

Malicious code in jexkcode (npm)

Versions 1.0.1 through 1.1.4 of jexkcode automatically follow a hard-coded WhatsApp newsletter whenever a WhatsApp connection opens. The package waits three seconds and calls newsletterFollow without obtaining user consent or exposing a configuration option. The README advertises newsletter suppo...

MAL-2026-16197 Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16218 Malicious code in tol8t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27 package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at...

Malicious code in tol8t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27 package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at...

CVE-2026-12751 Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...

Malicious code in n8n-nodes-sysdiag2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...

MAL-2026-16162 Malicious code in n8n-nodes-sysdiag2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...