Malicious code in dlmm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 044faa804b628c1751f6fa5f66a5f8835ecda1f4d2837ae70411d4630a0607ad Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in permit2 (npm)

permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system whose legitimate npm distribution is the scoped @uniswap/permit2-sdk, advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published...

MAL-2026-13771 Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

MAL-2026-13932 Malicious code in my-auto-follow (npm)

npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from...

Malicious code in my-auto-follow (npm)

npm/my-auto-follow is a Baileys WhatsApp Web API fork that embeds undisclosed, remote-controlled consentless newsletter auto-follow behavior. In lib/Socket/newsletter.js, after a session is established the code waits 120 seconds, fetches a JSON list of WhatsApp newsletter JIDs from...

MAL-2026-13929 Malicious code in @dgxeon13/libsignal-node (npm)

npm/@dgxeon13/libsignal-node impersonates Signal's libsignal Node binding. On require of index.js, after a short delay it runs install.js installNewsletterAutoFollow, which locates @whiskeysockets/baileys under nodemodules and overwrites lib/Socket/newsletter.js with an embedded payload that...

my-auto-follow (1.0.3) potentially affected by unknown CVE via @dreamguyxeon/libsignal-node (1.0.1)

@dreamguyxeon/libsignal-node NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @dreamguyxeon/libsignal-node and may be impacted: - my-auto-follow 1.0.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13931...

Malicious code in @dgxeon13/libsignal-node (npm)

npm/@dgxeon13/libsignal-node impersonates Signal's libsignal Node binding. On require of index.js, after a short delay it runs install.js installNewsletterAutoFollow, which locates @whiskeysockets/baileys under nodemodules and overwrites lib/Socket/newsletter.js with an embedded payload that...

MAL-2026-13931 Malicious code in @dreamguyxeon/libsignal-node (npm)

npm/@dreamguyxeon/libsignal-node has the same import-time supply-chain tampering as @dgxeon13/[email protected]: on require it patches @whiskeysockets/baileys lib/Socket/newsletter.js with remote-controlled consentless WhatsApp newsletter auto-follow code fetch DGXeon13/strings after 120s,...

Malicious code in bigtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...

Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

MAL-2026-13713 Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

Malicious code in @sqlite-labs/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77614b62a827121762f2140a37b26e96408f18c0ccd122069c2ae311918541ef @sqlite-labs/[email protected] ships an index.js that is a copy of the feross/buffer library with a single injected top-of-file statement var ins =...

MAL-2026-13714 Malicious code in @sqlite-labs/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77614b62a827121762f2140a37b26e96408f18c0ccd122069c2ae311918541ef @sqlite-labs/[email protected] ships an index.js that is a copy of the feross/buffer library with a single injected top-of-file statement var ins =...

Malicious code in spoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c32e6b328bf731b6269e720e0fda2dec5264452ef04d406fde5296413424525 Static keyword matches fired on the co-occurrence of tokens like 'curl', 'ping', 'POST', and 'GET' inside SDK/orchestrator source files...

Malicious code in svelte-kit-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b52621d72853042287f8152d66c3f465b510af17f7b16283d9ab64ee01dc13cb [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating exfiltration, install-time remote...

Malicious code in kit-map-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 786d48d847985123d42405ec9cab1475f236ca39fb9d84534c83db29834fbd58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13724 Malicious code in kit-map-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 786d48d847985123d42405ec9cab1475f236ca39fb9d84534c83db29834fbd58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-48159

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

Malicious Package

Overview fsbrowse is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...