MAL-2026-15862 Malicious code in py-2equests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bd7b93cf88d0fbcca30c50d9c9de6e14134cd2890be5a7a785e9330e98a988c py-2equests is a typosquat of the popular 'requests' package substituting '2' for 'r'. On import py2equests, the top-level module body iterates...

Malicious code in @a23842/dsh-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e90a9b8f9d25fdfb423c0110bb478302a429e4746efa54bdabb2885bc4e8bce The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dsh-waste-market (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff08b82d3f992d5249efc4a0914c649542386b248af94f4aea510abc51dad0d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15879 Malicious code in dsh-waste-market (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff08b82d3f992d5249efc4a0914c649542386b248af94f4aea510abc51dad0d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15887 Malicious code in html_vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1617e904ee9a3f603febf67c0fac2f7a3c80032d623015264de2daf983e64e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7221ac368a033274adc0a36ebde3b997cdb7ea0fe82b4f6cea1b75e8f37bca9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in html_vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb1617e904ee9a3f603febf67c0fac2f7a3c80032d623015264de2daf983e64e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15894 Malicious code in vscode-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7221ac368a033274adc0a36ebde3b997cdb7ea0fe82b4f6cea1b75e8f37bca9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15872 Malicious code in @a23842/dsh-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e90a9b8f9d25fdfb423c0110bb478302a429e4746efa54bdabb2885bc4e8bce The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15863 Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15858 Malicious code in trongridi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103 The package exposes a single public function permprivatekey that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint...

Malicious code in trongridi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377339f830834c0b61f370dd642f368374d9551b8b51822d79a902b4b403103 The package exposes a single public function permprivatekey that POSTs the caller-supplied TRON wallet private key as JSON to the hardcoded endpoint...

StreamRat Android malware spreads through Meta and TikTok ads

A malicious advertising campaign promoting a fake free TV-streaming service reached roughly 570,000 Meta users. The researchers who discovered the campaign found that its streaming-themed ads were aimed at Spanish-speaking users, with most observed victims located in Spain. One Meta campaign ran...

MAL-2026-15855 Malicious code in @quantixfinance/tron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf106f622a8d60232e7d296737eab7e44ffc42a598f40b4b2afea24aaa15f7c The package's declared preinstall script iterates process.env, filters keys against a broad credential/secret keyword list key, secret, token, pass,...

Malicious code in @quantixfinance/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a @quantixfinance/[email protected] ships an inert library body index.js exports an empty QuantixSDK class and a createClient stub while its preinstall lifecyc...

Malicious code in @quantixfinance/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32aaaa83ee6908df0267edb30ac90d4c87ef22bb803f2aca0c97b15348af95d4 The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions. The real behavior is in...

MAL-2026-15857 Malicious code in @quantixfinance/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18cabdbe5d59eb5064ea44a0a73db01d23affa7975049251454f599210aa79e3 The package advertises itself as a wallet library but ships a 67-byte no-op index.js; the entire payload is a preinstall lifecycle script that fires...

MAL-2026-15854 Malicious code in @quantixfinance/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3 The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords key, secret,...

MAL-2026-15848 Malicious code in @quantixfinance/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains...