MAL-2026-12019 Malicious code in @keyv/postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16a1c036c4437e534d6eca401133f16bd83f08e0ca4b656c8bef0906eaad2a5 @keyv/postgres is the PostgreSQL storage adapter for the keyv key-value store library. The package exposes a storage adapter API and does not exhibit...

Malicious code in @servicetitan/suppress-warnings (npm)

npm/@servicetitan/suppress-warnings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11524 Malicious code in keyv (npm)

npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

MAL-2026-11523 Malicious code in cache-manager (npm)

npm/cache-manager version 7.2.10 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in launchdarkly-ai-server-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 460d36c416400537f8c90171c7821b191e0af69df3ec9f0c906300f50b0ea93f launchdarkly-ai-server-sdk 1.0.1 pypi was scanned across 7 files with no a static rule matches and no traced behavior of concern. No install-time or...

MAL-2026-11518 Malicious code in exnesss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184796b4aafee8400786643e9f43338886de2166171c62879cfd4c023655b487 Package name 'exnesss' typosquats 'exness'. The package.json declares scripts.postinstall: 'node./postinstall.js', and postinstall.js issues an HTTPS...

Malicious code in @zzzgenesis00/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029e4462d0c27bbfd619024ba7311a0ecefef1ce551dba08ea57e920047e246 Package @zzzgenesis00/bip39-generator impersonates the bitcoinjs project author field set to 'bitcoinjs', repo URL pointing at...

Malicious code in instalogin1234 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7d01985e4b5c4afe1e4aafc0eb9a3d97feb1eacae68ef70adf962846392460 The package presents itself as a 'Modern Instagram CLI' but its login command displays a fake Instagram login prompt that reads a username and passwo...

MAL-2026-11503 Malicious code in instalogin1234 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c7d01985e4b5c4afe1e4aafc0eb9a3d97feb1eacae68ef70adf962846392460 The package presents itself as a 'Modern Instagram CLI' but its login command displays a fake Instagram login prompt that reads a username and passwo...

Malicious code in simple-date-formatter-new-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 628527c388185356d23a8905edf240a32c062afb06c00a58c0101ffd4bcc5182 On npm install, the package.json postinstall hook executes a shell one-liner that attempts to mount the host block device via mknod, enumerates...

Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...

MAL-2026-11501 Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...

Malicious code in list-issue-predecessor-dependencies-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd4d4e3aa51ec1a7ebc0a0d4f728698503432546f139f67998849f8fff9b614 npm package [email protected] auto-executes index.js from three lifecycle hooks preinstall, install, postinstall on np...

Malicious code in @custombots/custombot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b88fd82e9d147a4fad43b89bab0b975fe57714abf16356eb39ec0ae62dcc7949 index.js opens a TCP connection to a base64-obfuscated IP address decodes to 85.137.253.124:1111, spawns /bin/sh, and pipes the shell's...

MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...

Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...

MAL-2026-11426 Malicious code in trtllm-subdir-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d2babc3deb7dd71a0515beeb63a43a5ab1b24bea455226652da9ea9377d1e5f setup.py performs an unconditional HTTP GET to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/trtllmsubdirtest at install time...

MAL-2026-11424 Malicious code in telerape (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious...

Malicious code in capacitor-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02650efb5b0f2e8ca581f927c0ca3e50966bc8b425e81a6e2dc9f45c70234422 Package name typosquats the legitimate @capacitor/assets. On postinstall via postinstall.js invoking lib/report.js, the package collects developer...

MAL-2026-11423 Malicious code in asdk-plugin-legacy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 65dd9dd087b805a16fb5d68c92cf2be0ec28fec162d75bb0eb81bb8d9bcfb61a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...