MAL-2026-2476 Malicious code in strapi-plugin-nordica-recon (npm)

strapi-plugin-nordica-recon is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network...

Malicious code in strapi-plugin-nordica-cms (npm)

strapi-plugin-nordica-cms is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network...

MAL-2026-2482 Malicious code in strapi-plugin-seed (npm)

strapi-plugin-seed is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network topology. I...

Malicious code in strapi-plugin-logger (npm)

strapi-plugin-logger is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network topology...

Malicious code in strapi-plugin-monitor (npm)

strapi-plugin-monitor is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network topology...

MAL-2026-2457 Malicious code in strapi-plugin-cron (npm)

strapi-plugin-cron is a malicious npm package disguised as a Strapi CMS plugin. On install, it runs a postinstall script that executes an 11-phase attack: stealing .env files, environment variables, Strapi configuration, private keys, Redis data, Docker/Kubernetes secrets, and network topology. I...

Malicious code in @adac-fahrzeugplattform/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 779ce69d66db89d0bc1c8b82a373e6fed7e1b6a84d2cdf56bcab4b3076226f5f The package @adac-fahrzeugplattform/ui was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2130 Malicious code in fancode-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56c163153700b6fef7090e078a98b7c2403088e5c5f487344dc419af8adaa7 The package fancode-web-app was found to contain malicious code. Source: ghsa-malware a933e6c673f3cf2c4cb0e768570b64dcf627ac59e6b29c2e9afd5a5fb3d4396...

MAL-2026-2085 Malicious code in uipagain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce51f32914790894849b4c106fc9daf33bdbf5fc2cce5fbe8629a73ff78d2cbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-2018 Malicious code in @modals/blockchain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9883b4336552c287c2c3ed9bb5888cc22173cd8b39fd181552f858607f0ffa70 The package @modals/blockchain was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in characterai-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 376ab6840d12bf4d2b6ff51f365071cdefb5fae185ba150f7a8db8b70b925155 The package characterai-poc was found to contain malicious code. Source: ghsa-malware e45663d55a0e072d7245ee8cf3a8557710aef6e643c135b20a0918aa96d2da9...

MAL-2026-1260 Malicious code in webmd-url (npm)

Package exfiltrates data via pre/postinstall scripts, and has a suspicious main entrypoint targeting MongoDB configurations. Package extracts data like username, hostname and current working directory and sends it to malicious domain http://4v6heh2m.requestrepo.com/depconf/webmd-url/ --- -= Per...

Malicious code in vl-ui-action-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 681eef2c6f7a9061c23f448a351fbf64b8d5302e6343f486e534c4a440b1e793 The package vl-ui-action-group was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-716 Malicious code in si-wsl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f69e85a7d134f9914d7c06214a1e54622c4cd2548036f89a7de197a219cb598a The package si-wsl was found to contain malicious code. Source: ghsa-malware 883fa40693e776d8efd0a25d3d0cb70348f12f2226eaf627c28c490b46790973 Any...

MAL-2026-616 Malicious code in c11dff444 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d47b3f981fe050f2eab507069b880d1c47c4107c28eba0d1a16010400a249ad The package c11dff444 was found to contain malicious code. Source: ghsa-malware 437d8651f7d884d1905e0d01e2accffb3fcce5408fc4a6b0ef2ca6c37f0bade4 Any...

Malicious code in n8n-nodes-gg-udhasudsh-hgjkhg-official (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f177f9d8bad0a259983bc9f3e0880c59ee120b1e686e3f10b490ab0527beec3 The package n8n-nodes-gg-udhasudsh-hgjkhg-official was found to contain malicious code. Source: ghsa-malware...

CVE-2022-26534

FISCO-BCOS release-3.0.0-rc2 was discovered to contain an issue where a malicious node, via a malicious viewchange packet, will cause normal nodes to change view excessively and stop generating blocks...

MAL-2025-191231 Malicious code in @huntersofbook/form-naiveui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdec58532c2efc0e228886d82b5dd62cd0699f654168e5c792e524b3a2d73747 The package @huntersofbook/form-naiveui was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191415 Malicious code in react-scrambled-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3888a54f9c5c14abb5fd0b64ec41778b1bc989da36cd5e48a480514eb81b9e57 The package react-scrambled-text was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191308 Malicious code in @quick-start-soft/quick-remove-image-background (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f9fbf3fe9e4ab7de62ad125cf8376c5b6f00b67df5291788b607659981ff021 The package @quick-start-soft/quick-remove-image-background was found to contain malicious code. Source: ghsa-malware...