MAL-2026-2164 Malicious code in @rexxtheproject/elaina-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b062d07817c63636edc363a279fdad6c40a72e116a3abd59aba0e30854f059a The package @rexxtheproject/elaina-libsignal was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-as-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bcf6b93b6186112457361f81d21c00830bf0c48c75763de88d97f1b075944cf The package chai-as-chain was found to contain malicious code. Source: ghsa-malware 1d06397b7e66c2a8ecf1542a1f7d18b0f5a87d08a276dc88f77b1f8b2d818d47...

MAL-2026-2156 Malicious code in tailwind-animationbasis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 613bfa904c0195c7d59209123554b2be83ed4a0568c174e8b221e22725fec103 The package tailwind-animationbasis was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2157 Malicious code in transitive_lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7101b480572afd554e3cd28c310430828008015d4aed72012701cf6dd8d6c2 The package transitivelib was found to contain malicious code. Source: ghsa-malware 04d00d39fd7e8aaed1fa694a109cc857c0445a0192b768e39efae8b0e8bdc42c...

MAL-2026-2153 Malicious code in @xvortexsockets/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6fe781d4e79519992d2b0f37577515da41d7e0deb2f9f32df7c39dfb8de3916 The package @xvortexsockets/baileys was found to contain malicious code. Source: ghsa-malware...

Guidance for detecting, investigating, and defending against the Trivy supply chain compromise

In this article 1. Analyzing the Trivy supply chain compromise 2. Detection and investigation 3. Mitigation and protection guidance 4. Advanced hunting queries 5. References 6. Learn more On March 19, 2026, Trivy, Aqua Security’s widely used open-source vulnerability scanner, was reported to have...

Malicious code in mattermost-data-warehouse (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50f2483a1650869326d4fddf7bf66bc1dc6e6d614300cf8b41577595ded48165 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in roboat-util (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 869ea4b94181bc5ef23562a4d749b462fb7079112cca74072ee9036fb397921f During installation, a malicious executable is downloaded and run. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2026-2142 Malicious code in roboat-util (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 869ea4b94181bc5ef23562a4d749b462fb7079112cca74072ee9036fb397921f During installation, a malicious executable is downloaded and run. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in roboated (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c9f3bba9c27e61fbe6934c9d130ada39dd87f7b7c376fe33609be1ecbaf96e2 During installation, a malicious remote executable is downloaded and run --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

MAL-2026-2393 Malicious code in this-is-my-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d72a917ddcec635fc210d8767a9c289b6d43128c589de76fe7c0548da33878d2 The package this-is-my-test-package was found to contain malicious code...

MAL-2026-2389 Malicious code in spectral-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b458f8a3676b73711c711d763768712cc0bf1f7fb7233a87fb8b5817b7c509c The package spectral-module was found to contain malicious code...

MAL-2026-2373 Malicious code in my-little-durgham (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebd82bcebf08ed109a462bd365260e6e503b9e10c3645cf696f863a23b4f3614 The package my-little-durgham was found to contain malicious code...

MAL-2026-2369 Malicious code in loadshh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1d004f6eea15c013bd06ee8a4dd18dff1443aacb9ced1b110a7d05f59bc5438 The package loadshh was found to contain malicious code...

MAL-2026-2363 Malicious code in env-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b65432f04e2d76673de1e30fd9afbce2259306e45f6590848f02eb6f72535333 The package env-extend was found to contain malicious code...

MAL-2026-2339 Malicious code in chai-as-chains (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abf6eaadbaedff56f824c4c68f8af9138c01d40189e0225051d35c52dee1adc9 The package chai-as-chains was found to contain malicious code...

MAL-2026-2337 Malicious code in chai-as-aligned (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bfc79b3c746510178bdaa8e79ecf903f3705e61a09a5846e263159301607f91 The package chai-as-aligned was found to contain malicious code...

MAL-2026-2336 Malicious code in cdnjavacss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fb57ffd656f0a20fd4da4f7364cf96e67191700bda0682462b0ea9c68de1bb1 The package cdnjavacss was found to contain malicious code...

Two litellm versions published containing credential harvesting malware

After an API Token exposure from an exploited Trivy dependency,two new releases of litellm were uploaded to PyPI containing automatically activated malware,harvesting sensitive credentials and files, and exfiltrating to a remote API.The malicious code runs during importing any module from the...

PYSEC-2026-2 Two litellm versions published containing credential harvesting malware

After an API Token exposure from an exploited Trivy dependency, two new releases of litellm were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. The malicious code runs during importing any module from the...