MAL-2026-17448 Malicious code in prastzy (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17452 Malicious code in xcvrenzcompany (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in @fmr-ap149494/apex-base-component (npm)

Source: ossf-package-analysis e3505d2eebf31d1938862b6f6744d353fadaf980b9a27860f2a7c36d863828b9 The OpenSSF Package Analysis project identified '@fmr-ap149494/apex-base-component' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated wit...

Malicious code in fabtoolkit (PyPI)

Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from https://transfer.archivete.am/H2Uxm/fabdeploycheck-config.jso...

Malicious code in @fcsmc/commercial-analytics (npm)

Source: ossf-package-analysis 2a6c1e570c16bbf3b94ecc31e622c4d31be7c8575c90eaffc238ca1ef36e659d The OpenSSF Package Analysis project identified '@fcsmc/commercial-analytics' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

MAL-2026-17927 Malicious code in fabtoolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from...

Malicious code in fabtoolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from...

inspec_cve_2019_15224

a malicious rest-client gem On August 19, 2019, it was discovered that the rest-client gem had had several versions published containing malicious code. In discovering the malicious rest-client, several other new gems were determined to be carrying similar code. Coverage:...

Malicious code in ukraine69 (PyPI)

Source: kam193 751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in ukraine69 (PyPI)

Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in...

WordPress Rank Math SEO PRO plugin 3.0.123 - Unauthenticated Embedded Malicious Code vulnerability

Unauthenticated Embedded Malicious Code vulnerability discovered by ? in WordPress Plugin Rank Math SEO PRO versions 3.0.123...

MAL-2026-17907 Malicious code in @beloved-lenora/opencode-shell-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8dd8daa41992a2f1dec185b6924f6cc81b7172b55cccd6930f062317984ba8 The package presents itself as a safety guard that reviews shell commands before execution, but contains an undocumented branch that activates when t...

Malicious code in @flexmr/survey-conversation (npm)

Source: amazon-inspector 20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374 package.json declares its sole dependency cache-format-syntax-tracer as a bare HTTPS URL https://artifacts.creditslib.com/npm/cache-format-syntax-tracer rather than a registry version range. On npm install,...

Malicious code in @flexmr/survey-client (npm)

Source: amazon-inspector ed5d0e26b18d32568569b828bdbe2ccb40d0c4a54780c6e51be6280cb5fc851f @flexmr/[email protected] declares its sole dependency 'marker-index-symbol-schema' as a bare HTTPS URL to https://artifacts.creditslib.com/npm/marker-index-symbol-schema instead of a registry version...

MAL-2026-17899 Malicious code in @flexmr/survey-conversation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374 package.json declares its sole dependency cache-format-syntax-tracer as a bare HTTPS URL...

MAL-2026-17898 Malicious code in @flexmr/survey-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed5d0e26b18d32568569b828bdbe2ccb40d0c4a54780c6e51be6280cb5fc851f @flexmr/[email protected] declares its sole dependency 'marker-index-symbol-schema' as a bare HTTPS URL to...

MAL-2026-17892 Malicious code in xmd-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79a85f0f80af9a736d2f4a26eb74220eeaa0f7deb07ff911a822221a980f78df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17439 Malicious code in @developmentyora/baileyss (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17890 Malicious code in @developmentyora/yorakids (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d16bc35a010f7219764c00ca6703b36997bf3ccdf410b7e4cd71d043009938f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17891 Malicious code in asistenyorstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 159e4bc42ce900113481aa39dc41ea3c2bfe29a74a1cbb383cc80323dad13858 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...