MAL-2026-11027 Malicious code in fs-extra-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 402ae65ced8ae836bc92edf3622ea0d96d25d99d088d289481cd4332ddf1e38d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11029 Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7ad5acb0beb469a4f953cb1e1adab206bf03ad18d45c11b5cb895b1aff79114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11025 Malicious code in da-sc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 529aa128042d1720778ad1affadb1568f6bf39839a2874682db8d2f55a3b15f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11022 Malicious code in aio-commerce-lib-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9479591a21dd21e28dbd04aaf239e1da57eae40a248247d8e270d8e6f1278fdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11028 Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88a382e4c69ff8c5502f735bad1d59e7ea76ef65c55921193fbce8bdac5f4d7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11023 Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e251130fcb84c2b20ede3b09d95f501bd3b593c051cf0f95d6beba9b11949a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11026 Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11021 Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11020 Malicious code in hardhat-gas-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bc0a3828194aac457c89426a616772e54d6aa3868e1b0980b3e31bbbb20808c9 The OpenSSF Package Analysis project identified 'hardhat-gas-tracker' @ 1.0.1 npm as malicious. It is considered malicious because: - The packag...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11011 Malicious code in encrypt-string-ttak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb8d4c8e562697925ed58fe79611f3adaeb70f5143c2b78ac1dce0c5e501c441 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11004 Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...

MAL-2026-10997 Malicious code in n8n-nodes-http-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0109ab57af20f91ac1aa18ef76721b43437b80b9281bc16d5f4f2a47380935af index.js executes a top-level IIFE on module load that 1 spawns /bin/bash wired to a TCP socket connecting to 103.27.109.184:8895, giving the attacke...

MAL-2026-10998 Malicious code in n8n-nodes-port-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cffdebe2e0a27deb3751af547baace8a403244cb92d214db726d3700a192d61e index.js executes a top-level IIFE at require-time that 1 runs hostname, hostname -I, id, ip route, ip neigh/arp and reads /etc/resolv.conf, opens a...

MAL-2026-10996 Malicious code in init-js-examples (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6005f6b51f3286b65f92b6c8dd73d51c744f89428bbb238f2186b61b7112e6c2 The package's postinstall lifecycle hook runs setup.js, which opens a TCP socket to the hardcoded remote endpoint 130.61.90.45:4443 and wires the...

MAL-2026-11014 Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5db4f6fb4cd8bc8073e03771776ba865f51f852120bd44162573774905ccf22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11010 Malicious code in calvora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d42150b238e61e7ade93da3750393fdd09523b36d5794ed80e57c6a183029a66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11009 Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd65d988f18a0f4c26e80ba1051269692e38e3461369a9cc62a0314755b06aee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11018 Malicious code in veldora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2e3a6a16c04af92c19ea149ef526996cdaea7357b931cdbccedffd6237f598e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...