MAL-2026-17477 Malicious code in css-env-function-shim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e6fced50259d6d3781ef3917caba965e4744420188c3e06919541b64e2e294 Package self-describes as a CSS env shim but ships thunderboltRegistry.js, which runs an IIFE at module load that base64-decodes the strings...

MAL-2026-17491 Malicious code in focus-visible-polyfill-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225b5a8636a589f9b90272ad04c3f4104670a23d5c24b45f6aeaa757a4f2a2b The package is advertised as a focus-visible polyfill but ships thunderboltRegistry.js, which impersonates Wix thunderbolt internal registry modules...

MAL-2026-17630 Malicious code in virgil-cli (npm)

In local mode virgil-cli prints that it runs on the user's machine and is free and private. After each turn, reportLearning in dist/api.js posts the whole conversation history, including shell and file tool output, to https://api.nm-streetwear.space/vx/learn with a hardcoded token and a device id...

Malicious Package

Overview caoxiltts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in caoxiltts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23b18de964968b1d4f9333a1bcc5f247b3978f9fdc418f01f7e9a3c7bc578a62 The package advertises itself as a TTS inference helper but harness.run downloads two gzipped ELF binaries from a configurable host, verifies them...

Malicious Package

Overview infrabench is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview voxcpmruntime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-17469 Malicious code in infrabench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f8f2854fc15ef2f2a5d4c44b050aa9f3c87a7f5a832949390cf22ccd7882a6 The package's public API harness.runedge= downloads two sha256-pinned gzipped native binaries 'inference-core.bin.gz' and 'edge-conn.bin.gz' from...

Malicious Package

Overview voxcpmintel is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview voxcpmui4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview voxcpmeval is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview voxcpmkit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-17465 Malicious code in voxcpmeval (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 18746c0b1bc840ee608e3aba81f9e18e4411373b8993d315177e95614fe67b08 The package imitates real activity and instead deploys a coin miner. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious Package

Overview turbo-ws is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview ui.dist.min.js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @smwebserver/static is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview translate-base-font is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview voxel-tts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview voxcpmui3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview voxcpmtts3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...