MAL-2026-7062 Malicious code in @combinezone/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-9062 Malicious code in uxjinalamb2 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7905 Malicious code in lbcaltestcwukld (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7866 Malicious code in lamhgtestgoog13067 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-6055 Malicious code in @mastra/node-speaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1fc45cd66b93c4e1a83c1743f1ac9ee3ebea854208b1a9cae83ee957ebfd83 @mastra/node-speaker is a PCM audio output library wrapping native mpg123 bindings. Its package.json declares 'easy-day-js' ^1.11.21 as a runtime...

Malicious code in @mastra/turbopuffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73c50676f96c5af47167ce4405b1f53a38feb3cbd8a3eaf93fe262479680403 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5685 Malicious code in @malwguy/ecto-corsair-whisper-3d2a7c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b95a5cb65b01f03aebc1ab713877cb963b5de2cb4ddc38c03cdb01a7e469144 On npm install, postinstall.js walks /, /app, /home, /opt, /root for files whose names match /flag|secret|env/i, reads their contents, scrapes...

MAL-2026-3277 Malicious code in edj-shopify-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e23978c8bb0369f485f8c3e2384f10d9e649d13a3c198475ace4184c3757a5 The package edj-shopify-theme was found to contain malicious code. Source: ghsa-malware...

Malicious code in npm-demoo-1111 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c2199a37f518fbd8345def58b16a83c07aaf6aae9b837f6ec6d96a179f97849 The package npm-demoo-1111 was found to contain malicious code. Source: ghsa-malware 12073b21cd21241e9d8a004221c9e22d323091d95e7b5b9bdde2f1b20883aea4...

Malicious code in developit (npm)

The package 'developit' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...

RUSTSEC-2026-0032 `dnp3times` was removed from crates.io due to malicious code

The dnp3times crate attempted to exfiltrate .env files to a server that was in turn impersonating the legitimate timeapi.io service. It was loosely trying to typosquat the dnp3time crate, but otherwise was the same attack as the timecalibrator and timecalibrators malware yesterday. The malicious...

Malicious code in spark-ar-jest-mocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a67c582fb00bd7fd05adc5f9680fed203dd43086ab6efbcbec369bb386eaeb6f The package spark-ar-jest-mocks was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192998 Malicious code in @vietmoney/react-native-smart-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdecb4163903c7cab6a325ea865641719253be69a34f76a172a717792a8b53bb The package @vietmoney/react-native-smart-gallery was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192872 Malicious code in sturdyfetch3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51688b3b85839d3b57f16cceb31d5a8eea4de19c3d9ad73395386c9a7b0ef1ca The package sturdyfetch3 was found to contain malicious code...

Malicious code in ctfvamp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60afd58ec7b3c88e49140c847bac2c30a9e0e6d9f4f700125d59a3302bb9dac2 The package ctfvamp was found to contain malicious code. Source: ghsa-malware 813e410e18d7609781e8b8a67e5750a2e2652e69245b8a6d343d9ea8364d75a6 Any...

siddheshtea (=1.1.6) potentially affected by unknown CVE via nudela-aahaf0gf-gaafodfa (=1.0.0)

nudela-aahaf0gf-gaafodfa NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nudela-aahaf0gf-gaafodfa and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163708...

siddheshtea (=1.1.6) potentially affected by unknown CVE via muklis-39 (=1.0.0)

muklis-39 NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on muklis-39 and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-160823...

siddheshtea (=1.1.6) potentially affected by unknown CVE via muklis-30 (=1.0.0)

muklis-30 NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on muklis-30 and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-160815...

siddheshtea (=1.1.6) potentially affected by unknown CVE via muklis-29 (=1.0.0)

muklis-29 NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on muklis-29 and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-160813...

siddheshtea (=1.1.6) potentially affected by unknown CVE via nokire-nakala42 (=1.0.0)

nokire-nakala42 NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala42 and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-162995...