MAL-2026-16424 Malicious code in @wizloft/harness-cli-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f530bcd1820c18dbf9109139f6895ba89b5bec5b18ac374b85398844c0eabccf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16432 Malicious code in @wizloft/harness-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 328a1e142939c4523f9be9f14f94ae40f314f2c8ff7f2531e7474c02100ec523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wizloft/harness-plugin-file-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0ed60b35df86f2e566ba9ced2508d217d9dd009210bbf0e6cfea17520930ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wizloft/harness-evidence (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1e54dc6763e284dc9a6e7c32583fed8ff36a3a8f7e3c825f6582f679759772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wizloft/harness-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f75e92a7cec5020ee919ce491b7a30dfc43594192c2f6fc5aa18d42cd3bed75f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wizloft/harness-plugin-file-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16429 Malicious code in @wizloft/harness-plugin-file-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0ed60b35df86f2e566ba9ced2508d217d9dd009210bbf0e6cfea17520930ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wizloft/harness-plugin-memory-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3c19162b88e3e800090cd1ebf21d351e27126fa964f4084286612b1637bb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16423 Malicious code in @wizloft/harness-authority (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2542159f7d73b577f433cb116a9daa153a2fe6ec1732e7e1c5619dcb0d81aefc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16430 Malicious code in @wizloft/harness-plugin-file-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16426 Malicious code in @wizloft/harness-evidence (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1e54dc6763e284dc9a6e7c32583fed8ff36a3a8f7e3c825f6582f679759772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16422 Malicious code in @httttt/mcp-npx-fetch-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73432c5cbb8e74b1a4b66e91fdbde0eda311176dbef0301b13605d75bdd299ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16476 Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

MAL-2026-16475 Malicious code in memoryos (PyPI)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

MAL-2026-16421 Malicious code in kerokwis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 118186230c3ddb5c23ae32df8fed10655f2c64939daa9a09d5ef71f16884a4f0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in kerokwis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 118186230c3ddb5c23ae32df8fed10655f2c64939daa9a09d5ef71f16884a4f0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-16420 Malicious code in kerokwis (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b2921b86b5414d75ef09db29e36e70d66085361090c4a55f83878b14463996ef The OpenSSF Package Analysis project identified 'kerokwis' @ 99 rubygems as malicious. It is considered malicious because: - The package...

Malicious code in kerokwis (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b2921b86b5414d75ef09db29e36e70d66085361090c4a55f83878b14463996ef The OpenSSF Package Analysis project identified 'kerokwis' @ 99 rubygems as malicious. It is considered malicious because: - The package...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...