MAL-2026-11475 Malicious code in pm-claude-skills-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc0f6d8952f1a97d549799a1e7723dba7a9907b72b0c7a4d097776ddd1d8603 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11462 Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca3596032239f2a982b11e2846e8af25975d77f3f7c211a32f68e5a451ead883 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11480 Malicious code in routerbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bcc3239685adaf9098cfcf2a9f30c0018357be5ad058caf2046534c516bc3a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11468 Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac64235a2bc0c05f17f524b335ed7277658194e8dc3394597f2baca8eb17f7fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11476 Malicious code in polyprompt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c83b81c4da433d42ff97456ac6c52970f52de665ee78be41fd4c4ee34705adf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11463 Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6d0c7798c31f2743649318d78a1937fd28af9e4c28a2808046b647f2c087568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11467 Malicious code in iac-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64524c7a0044805e503f398bf4e7f890b40bc3225a8c7576cc71ec9c8a94e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11454 Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 647eefd97b5d8a0eac0be938122ebe0120152f6ded442d7616b18707bd26ea65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11421 Malicious code in asdk-plugin-ai-platform (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ba38202b0196fc58518ffc2cb0c0cd9067da9fec70d6bb371119b8175893b416 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11418 Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd7348ccf6d30158d05df90e15ebba938c30119c83b2ce6679cd69068dc667b In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

MAL-2026-11212 Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

MAL-2026-11198 Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 75c59285ee1a5a83447815e7402410ccfca6a287e0c36d61bcfda3d55396f608 Versions published in 2026-07 after the package was removed by the original author and the name was re-registered by another contain a stub 'share compute swar...

MAL-2026-11270 Malicious code in create-backend-scaffold (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f749e8b76ccc1619cfe98769cfcc133208c515f14ed198115a55587b28a49951 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11179 Malicious code in @zannstore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b310179032a3c10c00d359e9152740aa830a1d9d5ea97367f7b8b4d6d1f42569 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11161 Malicious code in @joyfill/layouts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48d31efc1aa4ad0afbb16e357a08eb80ab4c39bca8dab1723ead698363e0edc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11160 Malicious code in @joyfill/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61cf3fd63a92e5d2f5ffdbc70713656d7b347072c046aed9e9ba65fbc7c1e76e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11147 Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...

MAL-2026-11140 Malicious code in korvica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 065729796ad9ceb2c9939587ce1f61b78bdf36fc13807ace7e2383c22f5e61ba On import, a top-level async IIFE in index.mjs gates on process.platform === 'linux' and NODEENV!== 'production', checks for a WSL host mount at...