MAL-2026-16420 Malicious code in kerokwis (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b2921b86b5414d75ef09db29e36e70d66085361090c4a55f83878b14463996ef The OpenSSF Package Analysis project identified 'kerokwis' @ 99 rubygems as malicious. It is considered malicious because: - The package...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

MAL-2026-16416 Malicious code in @tvg-mar/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstruct...

Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

MAL-2026-16466 Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

Malicious code in poly-check-b (PyPI)

Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in auclean (PyPI)

Source: kam193 b337040219fb9c972fb5437f3546e662ba42d292657ad100b875c6224f152e71 During installation, the package executes embeded malicious executable. It then fingerprints the environment and network, looks for specific files, attempts to collect cloud credentials, and eventually attempts to...

Malicious code in snap-queue (PyPI)

Source: kam193 62bf582784fd41b3484157f6454ddcb6ab2ae10a5d93abeb19a5bfa5642b7e64 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in ubiquiti-agents-link-mcp (npm)

Source: ossf-package-analysis bb2bd11478a4b45a05adf8ac3c9b4ddeb169297b9c280916a25eccd4dd827922 The OpenSSF Package Analysis project identified 'ubiquiti-agents-link-mcp' @ 0.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with maliciou...

Malicious code in crypto-trader-py (PyPI)

Source: kam193 734dc70863cedc4f248265b79254d8bc4ac9dbbc40337ad7a5bbd45d9314500b During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in no-fun (RubyGems)

Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activit...

MAL-2026-16411 Malicious code in no-fun (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The payload does not run at install time, but upon invocation of the package. A language-specific loader then...

Embedded Malicious Code

Overview @memtensor/memos-cloud-openclaw-plugin is an OpenClaw lifecycle plugin for MemOS Cloud add + recall memory Affected versions of this package are vulnerable to Embedded Malicious Code. Malicious versions of this package ship a credential-stealing dropper, published 23 September 2026. The...

MAL-2026-16410 Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...