MAL-2026-16151 Malicious code in sql-limit-enforcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is...

Malicious code in n8n-nodes-sysdiag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a On require of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching...

MAL-2026-16147 Malicious code in n8n-nodes-sysdiag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a On require of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching...

MAL-2026-16149 Malicious code in os-info-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf3b4f18f9d98ad0792f96d750aef64b390ae6a516d948457d1e78b1d3242ab8 The package's postinstall lifecycle script runs unconditionally on npm install. It collects host identifiers hostname, platform, architecture, kernel...

MAL-2026-16160 Malicious code in lpulogin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e20ac78f11be43827182fe0907a1ca21cc0886163235aa9c5aeaae37ce8e88 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in lpulogin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e20ac78f11be43827182fe0907a1ca21cc0886163235aa9c5aeaae37ce8e88 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16161 Malicious code in meraz-project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3081e87039a0a1582330f353797d15ba12cdb1c17828ab2ee7224b7c1ac4809 On npm install, the declared postinstall script bin/postinstall.js runs trackProject, which collects the installer's hostname, OS username,...

Malicious code in @merazmz/project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c3ed01b550c0abf9d9ab2297215b49b5a3b73dbce21cf0ff2f2b476341c57fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16157 Malicious code in @merazmz/project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c3ed01b550c0abf9d9ab2297215b49b5a3b73dbce21cf0ff2f2b476341c57fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in meraz-project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3081e87039a0a1582330f353797d15ba12cdb1c17828ab2ee7224b7c1ac4809 On npm install, the declared postinstall script bin/postinstall.js runs trackProject, which collects the installer's hostname, OS username,...

Malicious code in dilxztech (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16159 Malicious code in dilxztech (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @biz44/process-runtime-utils (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

MAL-2026-16171 Malicious code in @biz44/process-runtime-utils (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

MAL-2026-16172 Malicious code in @biz44/runtime-utils (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malicious code in @biz44/runtime-utils (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malicious code in @zaka13/thing (npm)

@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...

CVE-2026-77147: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

MAL-2026-16154 Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

MAL-2026-16200 Malicious code in @zaka13/thing (npm)

@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...