Malicious code in @aspect-security/argon2 (npm)

The package performs data exfiltration, arbitrary command execution in preinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b426577fc5361773d25297fdb9fce28835e15d9ab86909c6652f5c1b71c4e543 The package @aspect-security/argon2 was found to contain...

Malicious code in argon2-napi (npm)

Malicious package due to data exfiltration in preinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 256afce3626d671d3e6fe9a53923ab5e85da899bd5255e0b975fe5fc22ab417e The package argon2-napi was found to contain malicious code...

MAL-2026-2511 Malicious code in argon2-napi (npm)

Malicious package due to data exfiltration in preinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 256afce3626d671d3e6fe9a53923ab5e85da899bd5255e0b975fe5fc22ab417e The package argon2-napi was found to contain malicious code...

Malicious code in @langgraphjs/toolkit (npm)

Package collects and sends sensitive system info to a hardcoded server. The package masquerades as a LangGraph JS utility but contains a malicious postinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

RLSA-2026:5942 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive CVE-2025-61731 net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-25679 For more details about the security issues, including...

MAL-2026-2503 Malicious code in genesis-1p-tools-rpm-bundle (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d7a13386739eb38301be183f8fafa0281beef0adc59037619ca870c2b075cd58 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in devkitx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 533ba14fdd7bd4a9722b6958993e6814b7f5b492ed9664250012deab8161401b The package devkitx was found to contain malicious code. Source: ghsa-malware 6344b4de933cb52dfd12ac4a38d68b3ea57498248f6cb291252a1a56d9963b55 Any...

Malicious code in databasenaps (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4e63193532e90f42a370f4171248ffa344728b4699ba6615fbf61c0e7c9e1366 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-2502 Malicious code in databasenaps (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4e63193532e90f42a370f4171248ffa344728b4699ba6615fbf61c0e7c9e1366 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in databaselooks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dd73d73ace43286d9d97ccebb1f758b52cfd114774b862c5b568a7d1151d0112 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-2501 Malicious code in databaselooks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dd73d73ace43286d9d97ccebb1f758b52cfd114774b862c5b568a7d1151d0112 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious Package

Overview fluxhttp is a malicious package. This package is the part of North Korea’s Contagious Interview Campaign and contains malicious payload, weaponised to steal credentials, wallets, and enable remote access to affected systems. The package attempts to mimic a legitimate package and the...

Malicious Package

Overview dev-log-core is a malicious package. This package is the part of North Korea’s Contagious Interview Campaign and contains malicious payload, weaponised to steal credentials, wallets, and enable remote access to affected systems. The package attempts to mimic a legitimate package and the...

Malicious Package

Overview logutilkit is a malicious package. This package is the part of North Korea’s Contagious Interview Campaign and contains malicious payload, weaponised to steal credentials, wallets, and enable remote access to affected systems. The package attempts to mimic a legitimate package and the...

Malicious Package

Overview golangorg/logkit is a malicious package. This package is the part of North Korea’s Contagious Interview Campaign and contains malicious payload, weaponised to steal credentials, wallets, and enable remote access to affected systems. The package attempts to mimic a legitimate package and...

Malicious Package

Overview license-utils-kit is a malicious package. This package is the part of North Korea’s Contagious Interview Campaign and contains malicious payload, weaponised to steal credentials, wallets, and enable remote access to affected systems. The package attempts to mimic a legitimate package and...

Malicious Package

Overview apachelicense is a malicious package. This package is the part of North Korea’s Contagious Interview Campaign and contains malicious payload, weaponised to steal credentials, wallets, and enable remote access to affected systems. The package attempts to mimic a legitimate package and the...

Malicious code in a2a-chat-canvas (npm)

Malicious package due to suspicious callback URL, hostname exfiltration, preinstall script execution, and only one published version. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d466a45c588940f8279288c439a4665d5368f0a7642c966de8e9fd307bc028b3 The package...

MAL-2026-2524 Malicious code in a2a-chat-canvas (npm)

Malicious package due to suspicious callback URL, hostname exfiltration, preinstall script execution, and only one published version. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d466a45c588940f8279288c439a4665d5368f0a7642c966de8e9fd307bc028b3 The package...

MAL-2026-2497 Malicious code in commerce-utils (npm)

Malicious package due to data exfiltration to a suspicious host, combined with arbitrary code execution during preinstall. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb3d6d3a8a8898abe7e371e54753d5902a5062151888ccff6c656f5edac6ba6 The package commerce-utils...