MAL-2026-17665 Malicious code in animatecss-tailwind-adapter (npm)

animatecss-tailwind-adapter 2.0.6 was published to npm on 2026-07-28 by the account grant587holloway. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment...

Malicious code in animatecss-tailwind-adapter (npm)

animatecss-tailwind-adapter 2.0.6 was published to npm on 2026-07-28 by the account grant587holloway. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment...

MAL-2026-17646 Malicious code in tailwindcss-animatecss-keyframes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 899fab6d3e500a876f1edc1f38356bddbceba9eb47b26d2eb43ae953557342be The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17358 Malicious code in @ikyyjee/ikyysingle (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @ikyyjee/ikyysinggle (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in random-certs (npm)

[email protected] was published to npm on 2026-10-07 04:22 UTC by user weindeste. It presents itself as a generator of random self-signed certificates, but sample/cert.pem holds base64-encoded JavaScript between the PEM markers instead of a certificate. index.js lines 41-52 reads that file, stri...

Malicious code in vectorizers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1082db2b4593a2b60921a85d2f4c760a294a67b1a48007959d75d61f670dc87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17645 Malicious code in vectorizers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1082db2b4593a2b60921a85d2f4c760a294a67b1a48007959d75d61f670dc87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17644 Malicious code in random-certs (npm)

[email protected] was published to npm on 2026-10-07 04:22 UTC by user weindeste. It presents itself as a generator of random self-signed certificates, but sample/cert.pem holds base64-encoded JavaScript between the PEM markers instead of a certificate. index.js lines 41-52 reads that file, stri...

MAL-2026-17643 Malicious code in waie-crash-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426f906d1d4cd95820524551b4b4476b8bf6189f3017f454fd6037bd50af048e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in windows_registry_editor (npm)

Source: amazon-inspector b0bcad8f2c4bdd8438d2826d78f285454aa72dc719c9fb7d52a74928c5b999d0 The package windowsregistryeditor was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in store-webpack-config (npm)

Source: amazon-inspector 13f10add046b94b627520507423f73982964e7be0734c7b4909acee5710f1e7e The package store-webpack-config was found to contain malicious code. --- Credit: OpenSSF source...

MSC-2026-12684

The npm package css-reading-display-polyfill version 1.0.0 contains embedded malicious code in thunderboltRegistry.js. A registry-manifest.min.json maps seven Wix thunderbolt and editor registry bundle names to this file via static.parastorage.com/unpkg so that Wix's renderer loads it. The file...

EUVD-2025-211030

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

CVE-2025-15591

A Cross-Site Scripting (XSS) vulnerability exists in the Forums feature of OpenText Content Management Content Server . This flaw allows a bad actor to inject malicious code into a Forums web page. The vulnerability is associated with CWE-79 (Improper Neutralization of Input During Web Page Gener...

CVE-2025-15591 Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management

Cross-site Scripting XSS in the Forums feature of OpenText Content Management Content Server could allow a bad actor to inject malicious code into a Forums web page...

MSC-2026-12674

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Exfiltrating sensitive user system data –...

MSC-2026-12679

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: This package contained malicious code and was...

MAL-2026-17637 Malicious code in captchetat-angularv8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42f7daad88efbe9f205eeac64d38e81a766c27080026a7adeb5d85e1ac30573c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pinecone-experience/messages (npm)

Source: amazon-inspector 078ce187b38122a7eff5def33454871232cdd38bde7d35e7ee1968d0e98cd45c package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz hosted on a third-party Google Cloud Storage bucket rather...