Malicious code in abiundler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @mikudeveloper/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d03bf7166a5353a0b22409ebbb724ee53f24394c9ff340df668c970772796e28 This package is a fork of Baileys that declares libsignal in package.json as github:tenka-san/libsignal-node — a git dependency with no commit SHA,...

MAL-2026-16386 Malicious code in @mikudeveloper/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d03bf7166a5353a0b22409ebbb724ee53f24394c9ff340df668c970772796e28 This package is a fork of Baileys that declares libsignal in package.json as github:tenka-san/libsignal-node — a git dependency with no commit SHA,...

MAL-2026-16387 Malicious code in @mr-supun-fernando/supunmd-bail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repositor...

Malicious code in dip.ioc.extensions (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16544 Malicious code in dip.ioc.extensions (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16488 Malicious code in dip.infrastructure (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dip.ioc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dip.infrastructure.context (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dip.infrastructure (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16489 Malicious code in dip.infrastructure.context (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16543 Malicious code in dip.ioc (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in dip.api (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16487 Malicious code in dip.api (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in chai-logger (npm)

Source: amazon-inspector 566e54855d730e8555b93da4f8ea81faba72645079a7adcc3a05ea8bf8ad8ee6 The package presents itself as a Chai logging plugin but its main entry index.js requires ./lib/query.js, a 4 MB obfuscator.io-encoded module 23,868-entry rotated string array, T/j decoder wrappers,...

MAL-2026-16385 Malicious code in tlxbnhd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e415dbf226269704c2cd28b1783cf594f96880dd4688b26caf7f25a19e268237 The tlxbnhd package ships obfuscated preinstall.js and postinstall.js lifecycle scripts that, on npm install, download two files from...

Malicious code in tlxbnhd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e415dbf226269704c2cd28b1783cf594f96880dd4688b26caf7f25a19e268237 The tlxbnhd package ships obfuscated preinstall.js and postinstall.js lifecycle scripts that, on npm install, download two files from...

MAL-2026-16384 Malicious code in tldriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995 The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using...

MAL-2026-16383 Malicious code in mxdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...

Malicious code in mxdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...