Malicious code in ledweb (npm)

The package ledweb was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ledlamp (npm)

The package ledlamp was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ledvance-living-style-guide (npm)

The package ledvance-living-style-guide was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in leda-wormhole-astrometry-module (npm)

The package leda-wormhole-astrometry-module was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in leda-version-charon-command (npm)

Source: amazon-inspector 5efc36c94af702509b9815198776991ce6dfd2c01dd32fe0e8237c39cfbb6e36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in leda-selenology-phenomic-webpack (npm)

The package leda-selenology-phenomic-webpack was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in leda-protractor-exoplanet-frontend (npm)

The package leda-protractor-exoplanet-frontend was found to contain malicious code. --- Credit: OpenSSF source...

MAL-2026-16266 Malicious code in @kartyk-github-org/takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f59dc68aae74875f986021660cb054d4055e7f7113e31234e8a9589c44edfb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16263 Malicious code in tailwindcss-form-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eab685b70dc7394ba9eade13925f6da52267f61edcf8ba204bcf9ac3bd4c7bc The package publishes under the name tailwindcss-form-utils while pointing its repository field at https://github.com/tailwindlabs/tailwindcss-forms...

MAL-2026-16264 Malicious code in aiosendletter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29baa6f2cbfb2ef9907be7830505e33e82b5a1e6a45eb7f995022d09f5841f09 The package advertises itself as a 'safe bug reporter' but its init function archives the contents of %LOCALAPPDATA%\logs with shutil.makearchive and...

Malicious code in aiosendletter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29baa6f2cbfb2ef9907be7830505e33e82b5a1e6a45eb7f995022d09f5841f09 The package advertises itself as a 'safe bug reporter' but its init function archives the contents of %LOCALAPPDATA%\logs with shutil.makearchive and...

MAL-2026-16260 Malicious code in confx1789550882 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72ce9bca41cb0378952b582d6f115a3bffd2acea4999a90bae5f916428921b64 The package's main file index.js is an IIFE that, when loaded in a browser same-origin context e.g. via unpkg, reads location.href and document.cooki...

MAL-2026-16258 Malicious code in randompkgd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ebd1d508d7c8ae4aa2a0693b9d07720a837307b1a5c343c931c6e7d72d6390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95eb389e78a05b76dfefafd460f3280f3fabf8fcd1dfc55946b04bef84b26116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16255 Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...

MAL-2026-16259 Malicious code in randompkge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95eb389e78a05b76dfefafd460f3280f3fabf8fcd1dfc55946b04bef84b26116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16256 Malicious code in randompkgb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80714d50d1dce2dbe400bba24113e27d669cc28dfc0d2b9194214a6322d3dc45 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16257 Malicious code in randompkgc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce22b64e51787a332ae7c65afc8789c0fb3f806199aa79d72af9ff02eb867d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16254 Malicious code in pulse-pwn-9f3a2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8086e23ce4b6ff1ca043ca8d9c83f384455e0baee3d06cd79e8a0d5d52c04e1 index.js contains top-level code that fetches /profile and sends document.cookie together with the response body to a hardcoded webhook.site URL...

Malicious code in pulse-pwn-9f3a2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8086e23ce4b6ff1ca043ca8d9c83f384455e0baee3d06cd79e8a0d5d52c04e1 index.js contains top-level code that fetches /profile and sends document.cookie together with the response body to a hardcoded webhook.site URL...