Malicious code in vite-json-pwa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f9204782dfa050ba762ce8c8a35c01e9f7b1e8bf82e140854d182f9614080b6 [email protected] impersonates the legitimate vite-plugin-pwa package author metadata claims 'inna voik' while funding/homepage point at the real...

MAL-2026-6959 Malicious code in proton_pfff (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0aa190f5fe08b29ab6f7230c099bdc2a201b7d5212f434f9e44b2be1feba5de1 The OpenSSF Package Analysis project identified 'proton-pfff' @ 99.99.5 crates.io as malicious. It is considered malicious because: - The packag...

MAL-2026-6957 Malicious code in nodemon-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3900c92378db76295f8a47683d86e58b24625758b938f4cd89ac779f86ed5260 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6958 Malicious code in ts-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b23f2fdd555b9d136a783785826f911a543e2cfaa423a335267c3dcb74fac60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6955 Malicious code in hello244b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 641cbcb87d26ccab92d1273dd083f15fa88ba5dad915c148f6500789f4596e4a The OpenSSF Package Analysis project identified 'hello244b' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2026-6952 Malicious code in whs4_npm_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68d797ee3c8111cffee8603aa24625cb71a7f958438e33207b33376b260acc59 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6946 Malicious code in @whs4/whs4_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c81447f382f370870e9dccf39168ae4d5b8105b5a94f04c7b541bbcc43598f99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in whs4_nmp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a1fc3c42fcd64070dd50db1ed23a9f238bd10fea9bba087cb605f7419af28c The package's postinstall script runs node index.js on install, which invokes reportLoadedFrom to POST installer-side data to a hardcoded Discord...

MAL-2026-6950 Malicious code in whs4_nmp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a1fc3c42fcd64070dd50db1ed23a9f238bd10fea9bba087cb605f7419af28c The package's postinstall script runs node index.js on install, which invokes reportLoadedFrom to POST installer-side data to a hardcoded Discord...

Malicious code in whs4_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47695d571fe82fbb4402e8cc7f56c05e1cb21d0bc8089ccbd8fca32f8cf5a57c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6953 Malicious code in whs4_pnm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47d72187d8b59a9a40cb8397d064bc7319b20e19ee7d48b870432bd96952b089 The package declares a postinstall script node index.js that runs unconditionally on npm install. The script POSTs the absolute filename path which...

MAL-2026-6954 Malicious code in wsh4_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b6c0b02642cf1c4c0fe420fd03c0c129c21a544144878df4833373da1b98aab On npm install, the package's postinstall hook scripts.postinstall: node index.js auto-executes index.js, which builds a payload containing the...

MAL-2026-6951 Malicious code in whs4_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47695d571fe82fbb4402e8cc7f56c05e1cb21d0bc8089ccbd8fca32f8cf5a57c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in whs4_pnm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47d72187d8b59a9a40cb8397d064bc7319b20e19ee7d48b870432bd96952b089 The package declares a postinstall script node index.js that runs unconditionally on npm install. The script POSTs the absolute filename path which...

Malicious code in wsh4_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b6c0b02642cf1c4c0fe420fd03c0c129c21a544144878df4833373da1b98aab On npm install, the package's postinstall hook scripts.postinstall: node index.js auto-executes index.js, which builds a payload containing the...

Malicious code in runtimedev-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e049b6382f522be35ebc44b090d56723dacfc2fe15ffa05b345fe46f5aea392a The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan. The runtimedev-link bin,...

MAL-2026-6948 Malicious code in runtimedev-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e049b6382f522be35ebc44b090d56723dacfc2fe15ffa05b345fe46f5aea392a The package presents itself as "Pure Node.js telemetry for RuntimeDev platform" but implements a full remote-access trojan. The runtimedev-link bin,...

PYSEC-2026-1071 Malicious code in mem8 (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of mem8 were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and attemp...

Malicious code in polytrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bb6b9a4e70c868e150f06160b187915bcdeb6c9c8f95095af4766dde92f96c5 [email protected] advertises itself as a Polymarket API SDK, but the exported getPlugin function in index.js issues an HTTP request to...

MAL-2026-6939 Malicious code in polytrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bb6b9a4e70c868e150f06160b187915bcdeb6c9c8f95095af4766dde92f96c5 [email protected] advertises itself as a Polymarket API SDK, but the exported getPlugin function in index.js issues an HTTP request to...