Malicious code in sort-export-all (npm)

The package 'sort-export-all' is part of the PhantomRaven supply chain attack campaign Wave 4. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1318 Malicious code in @web-monorepo/fetchers (npm)

Package is malware. It exfiltrates data to a suspicious domain via callback.js, triggered by a preinstall script in package.json. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3faaa666cb666785670b3a638b1f832d4492f7eb2c999f41f7bb551cde2aa86 The package...

Malicious code in xrpl-dev-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e19d7ccfb5e9bebce90f062b458b8ac38691519308db3cb6bf846b54a387dad9 The package xrpl-dev-portal was found to contain malicious code. Source: ghsa-malware 4fda3daad7ee020ce9cee13e48a40a89de8040cc479f0c4ac9687198ccd576c...

MAL-2026-1193 Malicious code in cloud-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d014766db57fb4d6cceffc9e45821e7c14135a358abdc4db25a0310538266699 The package cloud-apis was found to contain malicious code. Source: ghsa-malware 34de661e0892c5941755ca8d9db5fbcd64da940f5b21755f4b20862a758fe769 Any...

MAL-2026-1195 Malicious code in consolelofy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9026237dcb17ce59b31ce42b7af60ddbe094cb955735a5dc1833275d5f01c7a The package consolelofy was found to contain malicious code. Source: ghsa-malware a251667effca1d80bd932709965abc6f6c61172812756404c3b8b2d7b340e23f An...

MAL-2026-1165 Malicious code in @global-dax-ad-platform/dax-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e50b13916c14b17a01e550d32711ed37f8842bc2a0eede3ea254df64f7a0af1a The package @global-dax-ad-platform/dax-components was found to contain malicious code. Source: ghsa-malware...

Malicious code in @daffadeveloper/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56c4d6e1233759183f848159d1b47ee443d914e4ce13251df4518a1a5becdbc6 The package @daffadeveloper/libsignal-node was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview expressjs-lint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-958 Malicious code in ethres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba3cafe0e65ebbd1b4bdd577f7277b921eb7e3cf52e5fb46d8e6f6f34b2debd5 The package ethres was found to contain malicious code. Source: ghsa-malware 10924cf4fae0e118a99b95cf45376a7f42ff743f1e8830e78e801c473e0ddd88 Any...

Malicious code in tailwindcss-forms-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91e47d3466ef7beca3f6d4cc16c77c91c52a3d29dbbe4d484fcf3e2397f18d2c The package tailwindcss-forms-starter was found to contain malicious code. Source: ghsa-malware...

MAL-2026-755 Malicious code in @jes4l/react-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbda4aa24c8a13be0d237b206780fc2feb5778e65cebf430e2124e49a390cdde The package @jes4l/react-pkg was found to contain malicious code. Source: ghsa-malware 2bd5520cca8e57269ded7f69993dc5257f9085a6706d01d7bc60b17ec80534...

Malicious code in react-vite-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9f5300073ebcda0869cf258bc5c567c6afc40942b14d14a97bfeaa2eaff1b9c The package react-vite-sync was found to contain malicious code. Source: ghsa-malware 971cc1d747c2d072e4a3cc272143be37bbd2162968dfd682012890e87cda562...

Malicious code in finnairshop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79d4d53f987d9f13e00e895d04155d3d28ea228eacb34a2f273667e520c5525f The package finnairshop was found to contain malicious code...

MAL-2026-475 Malicious code in @transaction-list/transaction-list-sm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f4c569b0a7bbd5a1213b7870b3bdd269026c012ca486789f9ab27e115862bbd The package @transaction-list/transaction-list-sm was found to contain malicious code...

Malicious code in ofjaaah-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0f994ed6a23b4449a3ab09537485788c488a90e26c56c52d309b4704d8d2da9 The package ofjaaah-build-tools was found to contain malicious code. Source: ghsa-malware...

Malicious code in aws-target-mediator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ebc5003f75ac973cedd53d212f4d9b3dc016b36e43b24ca0a10e77e485b9141 The package aws-target-mediator was found to contain malicious code. Source: ghsa-malware...

MAL-2026-72 Malicious code in bignumber.js-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92c6e02327f14620207af4a5e1925c400b63593f1200b4741e6da6fbed98324b The package bignumber.js-new was found to contain malicious code. Source: ghsa-malware 28010a58702c96fe7985f5d14aa8012e5f51e93f658c9de605cbd3e7437e18...

Malicious code in auto-backup-wsl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a2df4191bfbdaa28acd42677c912064639ef3b278179beee064cd83fb5b0e11e Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...

Malicious code in @peter_wilson12091/internal-json-test-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18430304f650bf998b2421e45c0b8b01fce58239d3dd6fbe9de753128aac9a4d The package @peterwilson12091/internal-json-test-parser was found to contain malicious code. Source: ghsa-malware...

Malicious code in huangmingming-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34b1eeb67a3d88661777e42783fdb91d2347376e8c6eae10588f559642d2bf53 The package huangmingming-demo was found to contain malicious code. Source: ghsa-malware...