Malicious code in apexpro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80f8783908329ceda250d21f3d9d39a117f80f8ca55c400c72065449d2a0bc1c The package apexpro was found to contain malicious code. Source: ghsa-malware fb2932c368cbb684114a08865c171d8af11aa8af3738e7d156f5692beccd48d5 Any...

MAL-2026-3007 Malicious code in json-dec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de1db9ce26e4c5f4788ebbf809fede48364dd0741a8f4d0aa5580fac4b199f59 The package json-dec was found to contain malicious code. Source: ghsa-malware ad7f787412af0259dfcb2bcbb7429600fcb3c8a92510c70699961455caddd9ad Any...

Malicious code in changelog-cli-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98a1e229322241da9d146f6aad5c96de566b2707088406fd7de40cbb69445023 The package changelog-cli-logger was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2994 Malicious code in @openwebconcept/theme-owc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba9da7f58491c9c4715c34da32da8f4a9d1519075412a9be534d19e6e07466e2 The package @openwebconcept/theme-owc was found to contain malicious code. Source: ghsa-malware...

Malicious code in @relxui/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b91a4fd21ef12fb1580ab9240c8b51f39c0ba26d19b683ebcac2d86ed7936e78 The package @relxui/react was found to contain malicious code. Source: ghsa-malware 1a95206a60abfe74a108e76e52361543b36e7d78ff34a1273b5cf4c1bb183d1f...

Malicious code in ih-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e7f19afb6ffd57012c61c6bef2ce8ad4238f192cac0679e216684a37ec672e The package ih-icon was found to contain malicious code. Source: ghsa-malware c7182707ae8272b3af4376c3dfec66a3b574b8c86217bf3b7c705d94dfb84b63 Any...

Malicious code in seaport-core-16 (npm)

Package exfiltrates user info to a remote server via wget in test, preinstall, and preupdate scripts. Very few published versions. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be2cd9e6e61b20566214a0627d5923ec7cbe799e9757d25fd883f46616e5b58b The package...

MAL-2026-2636 Malicious code in seaport-core-16 (npm)

Package exfiltrates user info to a remote server via wget in test, preinstall, and preupdate scripts. Very few published versions. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be2cd9e6e61b20566214a0627d5923ec7cbe799e9757d25fd883f46616e5b58b The package...

Malicious code in mcp-server-todo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f426e9e8a841f37f765614c031a1b4f56bb7ee1c8d5ed51b2aeb27a261edce9 The package mcp-server-todo was found to contain malicious code. Source: ghsa-malware d2e2326574c0d2811c6c20ff1523ad04fc4bdb6f062080751acdca4a592c68b...

MAL-2026-2224 Malicious code in jito-validator-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5744d7d3aef03ec852963ebeca1a6357db3aa7bc925bae6e85f173692fc12eb0 The package jito-validator-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2094 Malicious code in pulse-scroll-triggered-list-items (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5917623184677210f5a42bead660945379d7a3c1cabf055e011a2794a233d517 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-2080 Malicious code in cit-playwright-tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7b3ed19c372c719b1d1b35ada72bf080aa8bc45406114b8361a94360bf2eb48 The package cit-playwright-tests was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2061 Malicious code in @emilgroup/tenant-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d887c661a1552423bf923bf1028ef4aabb762dc2fa329db39e8b4552ce32803 The package @emilgroup/tenant-sdk-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-as-chayn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37e4fe08f70ebcaf1ebc9988e7ad2694a3b9708734e8623adcf930d1803bb72a The package chai-as-chayn was found to contain malicious code. Source: ghsa-malware 57e4b17532a62987684bdd644c433a1aa7c4955324bb06eb3c6f7ed702fa0ed3...

Malicious code in @metaplex-foundations/umi-public-keys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48abfc0f902cd0f09b0c2ae7449eaefbf3b4baf1cb12e4165f509b86f7ad8692 The package @metaplex-foundations/umi-public-keys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1923 Malicious code in sq-minimal-feature-flags (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-1525 Malicious code in peer-deps-external (npm)

The package 'peer-deps-external' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1556 Malicious code in yoshi-base (npm)

The package 'yoshi-base' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...

Malicious code in whatsapp-core-auth-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f0056922bde61f17500081c40e73bd86df9a2ec7688a11853a071aa3b4c6d8 The package whatsapp-core-auth-drzak was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview transform-charcodes is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...