Malicious code in gd-auth-sso (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8f23b8545f85df66640646272b028ab4db1032fcb4fd5bbd745971b3438cc4f1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2539 Malicious code in customer-local-ops (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef5d282201c89a99b3d50d086b0c6916792744bff406f01b7920533e43562212 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in customer-local-ops (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef5d282201c89a99b3d50d086b0c6916792744bff406f01b7920533e43562212 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in @b2b-portal/form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bfd3d2bf611173cd9899eb7ae28620ce52dd78812b47d5f9ca1fc68555c5b70 The package @b2b-portal/form was found to contain malicious code. Source: ghsa-malware 01b5517a25cba37fda750436dbbba1fe86b2c36fb7eafbbb0b49cf17d95e5a...

MAL-2026-2536 Malicious code in yhaplo1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea4e6c1525395c0b55d0de437d61b31250561c4901199518e13cd28fe15f232f Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not...

MAL-2026-2534 Malicious code in siempyl-sumo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 493e667735febe5b3e4cd2cc47ae0b5a09ddacf051dc2804e5e742574ceb5ec4 Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not...

MAL-2026-2535 Malicious code in ttam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2925c78ff71ef8aee744b1b6b4fa9b5cef3b6ae018447d29ba5e63fe43ad01c1 Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not...

MAL-2026-2533 Malicious code in phasedibd (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8d514af72edb0054d9c5ff73f59a8517927dc660a5a58c8a03baf8abc5b22365 Dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program. This package did not...

MAL-2026-2823 Malicious code in @genoma-ui/components (npm)

Malicious package detected. It uses pre/post install scripts to download/execute code and exfiltrate user data via curl from a hardcoded IP. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5fb9acd5bf2a73c82be9ac19b7c0cad285cfea2a4b6ff69655f61e7e4a0c26c The...

CVE-2026-39958

oma is a package manager for AOSC OS. Prior to 1.25.2, oma-topics is responsible for fetching metadata for testing repositories topics named "Topic Manifests" mirror/debs/manifest/topics.json from remote repository servers, registering them as APT source entries. However, the name field in said...

Malicious code in sjs-biginteger (npm)

sjs-biginteger typosquats big.js on npm. Published April 7, 2026 by throwaway account vanes.s.p.orit.a, the package ships legitimate big.js source and hides its payload in a dependency: sjs-lint-build1. On install, the dependency’s postinstall hook fetches the attacker’s SSH public key from a C2...

MAL-2026-2527 Malicious code in sjs-biginteger (npm)

sjs-biginteger typosquats big.js on npm. Published April 7, 2026 by throwaway account vanes.s.p.orit.a, the package ships legitimate big.js source and hides its payload in a dependency: sjs-lint-build1. On install, the dependency’s postinstall hook fetches the attacker’s SSH public key from a C2...

Malicious code in @signals-notebook/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6385e6085b941d851ce17c44dac94bb93521dad91d75b4d284a3dc8f9d367c2e The package @signals-notebook/utils was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2520 Malicious code in @signals-notebook/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6385e6085b941d851ce17c44dac94bb93521dad91d75b4d284a3dc8f9d367c2e The package @signals-notebook/utils was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in just4testlm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5aed012f2ecc4af261bb7f2fc294b9aee5c0733ccf207b9e9e9a381d51387811 The package likely tests different malicious techniques and delivering payload in setup.py. Different versions, like 0.1.0, 0.4.0 or 0.9.0 contain malicious...

MAL-2026-2514 Malicious code in gprofiler-logging (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9db75962c82806edd773390d37cc66b2fc0aee51a334a08ec938a011e5f8aeb Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in gprofiler-logging (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9db75962c82806edd773390d37cc66b2fc0aee51a334a08ec938a011e5f8aeb Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that mirrors the TeamPCP LiteLLM technique. What the postinstall payload does: - Harvests environment variables matching 40+ patterns AWS, GCP, Azure, GitHub, OpenAI, Stripe, etc. - Reads SSH keys, .npmrc,...

MAL-2026-2865 Malicious code in @sie-ppr-web-checkout/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 977089aabb00f7d390dd6bf7ad3e9038c4998ec2ccf93a2e38016f525c32f368 The package @sie-ppr-web-checkout/app was found to contain malicious code. Source: ghsa-malware...

Malicious code in @sie-ppr-web-checkout/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 977089aabb00f7d390dd6bf7ad3e9038c4998ec2ccf93a2e38016f525c32f368 The package @sie-ppr-web-checkout/app was found to contain malicious code. Source: ghsa-malware...