Malicious Package

Overview web3-eth-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview web3-sign-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview crypto-key-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bitcion is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview coinmarket-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview btc-wallet-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview base58-check-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview lightning-invoice-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview crylto-toolbox is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview browser-metrics-plugin.contrib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious Package

Overview @subql/common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bitcion-ruby is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in base58-check-helper (RubyGems)

Source: amazon-inspector 1fe852f0d3458d12270208daca66a3f83046929fcf8434d556261f89d578c06a The gem's ext/base58-check-helper/extconf.rb runs during gem install and, before invoking createmakefile, performs anti-analysis gating: it skips execution when CI environment variables are present, when the...

Malicious code in bitcoin-address-utils (RubyGems)

Source: amazon-inspector 8af579a1726db72e88f7c1755ebdec49a2d0a944d0e42a0fb36566d70d751e17 The gem's native-extension build script extconf.rb, which runs automatically during gem install, decodes a base64-wrapped Ruby payload that XOR-decodes a hardcoded URL approximately...

Malicious code in bitciin (RubyGems)

Source: amazon-inspector 73144cb471499af4467e7c8c2a6da34013285179444e101290faa7ec9fda0a19 The gem declares a native extension ext/bitciin/extconf.rb that runs during gem install. The shipped C source ext/bitciin/bitciin.c is a two-line empty stub void InitBitciinvoid and the Ruby library exposes...

Malicious code in bitcoij-ruby (RubyGems)

Source: amazon-inspector c5384d9d73ce11bd469153ec7603634889186391b9bd312bf84b3ace56950454 The gem declares a native extension ext/bitcoij-ruby/extconf.rb whose matching C source is an empty 50-byte Init function, so the extension exists solely to run extconf.rb during gem install. extconf.rb...

Malicious code in bip39-wordlist-utils (RubyGems)

Source: amazon-inspector 4b3ac427b6e4032e434211228b95b76c556690f86e9e3ba44134e2b8525253c5 The gem declares a native C extension whose shipped source ext/bip39-wordlist-utils/bip39-wordlist-utils.c is an empty Init stub, so gem install executes extconf.rb purely as a lifecycle hook. extconf.rb...

Malicious code in serpacksven2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 668c23a809283c521b8cee159ca2f57515729e664029b4fa63c1e1fbef1bd9fc The tarball ships ten identical files with misleading extensions 1.png, client.doc, json.txt, server.doc, for.you.doc,.txt,.txt.1,.txt.2, and an...

MAL-2026-17626 Malicious code in serpacksven1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d4a6a2715973b427bb0aa2b7a493ca711b7f16b5f47f90062edf790e0186a6 The tarball ships no JavaScript — the declared main: index.js is absent — and contains only 10 byte-identical copies of a PowerShell dropper under...

MAL-2026-17624 Malicious code in documenclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffd20318a8d48dc20fee95097373ebd1039481031985164a651d2b68d366565a [email protected] publishes an npm package whose only shipped content is a heavily obfuscated PowerShell script embedded in the README. The script...