OreNPMGuard

OreNPMGuard - Shai-Hulud Package Scanner Version 2.0.0 - Shai-Hulud 2.0 Detection & Enhanced Prevention System A security tool to detect compromised npm packages from the Shai-Hulud supply chain attacks original September 2025 and Shai-Hulud 2.0 November 2025. Scans both package.json and...

vet

Find malicious packages, vulnerabilities and risky CI workflows before they reach production. Install • Docs • Commands • Policy • Discord !NOTE This branch is vet v2, in alpha. vet v1 is on main and stays the latest release. The v2.0.0 release notes map each v1 command and flag to v2. Why vet Yo...

go-mal-pkgs

go-mal-pkgs A security tool to detect malicious Go packages by verifying checksums in go.sum against the original source code, bypassing the Go Module Proxy cache. Overview This tool helps protect against supply chain attacks that exploit the Go Module Proxy cache, as recently demonstrated by the...

CVE-2021-32804

CVE-2021-32804 This is a repository for building the Docker environment used in the yamory blog "CVE-2021-32804 Path Traversal Vulnerability in node-tar Affecting npm". Environment Setup docker build -t cve-2021-32804 . docker run -it cve-2021-32804 /bin/bash Vulnerability Reproduction node-tar...

Malicious code in thistlerun (PyPI)

Source: kam193 6c35afe278e655040c47dcca9e63b4ab75c1530880041568e544700daa20e887 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in runpier (PyPI)

Source: kam193 ab469bbd671fcc96fad392de06c7652a4f9ea899df3c86d285397bfc3985a690 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in thornqueue (PyPI)

Source: kam193 ea756029aedec54cd447267056236a9c4a6752d1a9973198ebf71c300fcd9112 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in cobbleload (PyPI)

Source: kam193 9cf9dcc227e75e864e1dffc62bc95b8d0f73dea45b088ed34ab718a8ab87fb08 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in ferretqueue (PyPI)

Source: kam193 00f1975c33600ed4869f6783ebd8d73e93e3a25f293b4f724ab2f4af2b1c9096 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in workslip (PyPI)

Source: kam193 6a509c00601b9f218feeb0cf12a7f84899efaf786edee659338d53d9888aa507 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in slatejob (PyPI)

Source: kam193 779bcb94eecf53cfda39d7bfeb12aac9de072d14b22904a6f7bf55e33c3e5e7f This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in jobwharf (PyPI)

Source: kam193 172e672abed0eeea77b62d2a9dea9999b59ff685b952fec68c70e2b227e0bce6 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in larchworker (PyPI)

Source: kam193 87e174c9dc2485263894e4d6c3d1560589659afbfbe9397ca1e1b53fb21d96b3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in brookworker (PyPI)

Source: kam193 b5143967b27cd16bb4d28cbef2272599e90443b5f651a57e8f42d32c2e8b4ce2 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in phonemeprobe (PyPI)

Source: kam193 e734952ed1638d020205fd4c071007902fd7b0b6671f1aa8eeb0b583efa75a08 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in benchworks (PyPI)

Source: kam193 606e74602d9241e80622f42ed81f9040fe733889abd2003a862704c1d2d72595 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in benchbridge (PyPI)

Source: kam193 7e329737ae059eda6e9d4d0e57c74c937cc38746b707cc5dbbceac5387fb6926 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in acoustichub (PyPI)

Source: kam193 8aa748656a3a49ab77d0532727632bbdcb820ac353745ee09b05a7e873d34a34 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in asrloom (PyPI)

Source: kam193 cd20eda3837d1f9497fcbd0cdf6826a2bff936766bac7e8d0a3f8b11ecaf15d3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...

Malicious code in audiokit (PyPI)

Source: kam193 ae10fa65b7a9cd16dbfc93eae72c57da03db18821aacd99a38e4bfa054df6e16 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign ...