Malicious Package

Overview @wxwxtest/testrrrdd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview testrrrd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-17702 Malicious code in kafka-helmsman (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...

Malicious code in @kxafunc/xbails (npm)

Source: amazon-inspector 629c665fbfef767c56d24af935d38312f7aa88d1c71d9dfb8c427192e54add0b package.json aliases the libsignal dependency to npm:@bellaxchuu/libsignal-node@latest — a non-standard publisher pinned to the mutable latest dist-tag with no version pin, no integrity check, and no hash. O...

MAL-2026-17701 Malicious code in @kxafunc/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629c665fbfef767c56d24af935d38312f7aa88d1c71d9dfb8c427192e54add0b package.json aliases the libsignal dependency to npm:@bellaxchuu/libsignal-node@latest — a non-standard publisher pinned to the mutable latest dist-t...

MAL-2026-17693 Malicious code in @bitwardne/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7d0b3168a3a56cb6208688970e6109a964ccfb99a97fe7061d57e007b67ca6 package.json declares a preinstall lifecycle script of the form 'curl -L | node', which fetches remote content and executes it in Node at npm install...

Malicious code in clickfix_npm_delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d The package has no library surface. package.json declares main: index.html and the tarball ships only that HTML page, whose sole purpose is a ClickFi...

MAL-2026-17692 Malicious code in clickfix_npm_delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d The package has no library surface. package.json declares main: index.html and the tarball ships only that HTML page, whose sole purpose is a ClickFi...

Malicious code in @galicia-toolkit/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be976704e590db4fd796db1569b0835af0dfc8d829e21282116f210a4c741a59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcss-ui-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deb799e18fe77928819080979322bbcc868ba4373af021aec1efea4b201e4108 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17686 Malicious code in tailwindcss-effects-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12c9b58efdc05227da51bfb1031a80205144b4c6945b06eb9cbad7d416ab4873 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17687 Malicious code in tailwindcss-ui-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deb799e18fe77928819080979322bbcc868ba4373af021aec1efea4b201e4108 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

Malicious code in system-driver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5e4a0cbbe434f312002efedefa09d6d1ad79d13300812d7b43e1302fd6e562 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-gyp-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcec19492c8bdcd8c866d1aad1a2b8a253d7d9bbc8184ff182af71a75ce56589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17684 Malicious code in node-gyp-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcec19492c8bdcd8c866d1aad1a2b8a253d7d9bbc8184ff182af71a75ce56589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17683 Malicious code in node-fetch-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17677 Malicious code in @bellaxchuu/overbugs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4bf34e6d2aa5b187e4dba9c90ce9515cd1fdc5a43f37195ba21e9cb418eb19c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bellaxchuu/familyxtrx (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17676 Malicious code in @bellaxchuu/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f70788aeca5b98fbe0c721d7f6a88c036d661c3f0132443a6bdb97080f5819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...