MAL-2026-16420 Malicious code in kerokwis (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b2921b86b5414d75ef09db29e36e70d66085361090c4a55f83878b14463996ef The OpenSSF Package Analysis project identified 'kerokwis' @ 99 rubygems as malicious. It is considered malicious because: - The package...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

MAL-2026-16416 Malicious code in @tvg-mar/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstruct...

MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

MAL-2026-16466 Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

Malicious code in poly-check-b (PyPI)

Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in snap-queue (PyPI)

Source: kam193 62bf582784fd41b3484157f6454ddcb6ab2ae10a5d93abeb19a5bfa5642b7e64 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in ubiquiti-agents-link-mcp (npm)

Source: ossf-package-analysis bb2bd11478a4b45a05adf8ac3c9b4ddeb169297b9c280916a25eccd4dd827922 The OpenSSF Package Analysis project identified 'ubiquiti-agents-link-mcp' @ 0.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with maliciou...

Malicious code in crypto-trader-py (PyPI)

Source: kam193 734dc70863cedc4f248265b79254d8bc4ac9dbbc40337ad7a5bbd45d9314500b During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in no-fun (RubyGems)

Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

Malicious code in auclean (PyPI)

Source: kam193 b337040219fb9c972fb5437f3546e662ba42d292657ad100b875c6224f152e71 During installation, the package executes embeded malicious executable. It then fingerprints the environment and network, looks for specific files, attempts to collect cloud credentials, and eventually attempts to...

MAL-2026-16411 Malicious code in no-fun (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The payload does not run at install time, but upon invocation of the package. A language-specific loader then...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...

Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...