MAL-2026-6386 Malicious code in evmdotjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2593392b2cb94ce2e63327e486ec5c1a2a738c76283c6b1958aa2b23a1cc7b0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in macos-ci-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f342b002e02396d7f82ee89e77140204c35b673411afd05bc1b3ca91c895a06 On first require of the package, index.js decodes a base64-encoded URL https://api.ingress-hub.com/cdn/assets/update.pkg and downloads the response t...

Malware in html-to-gutenberg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware Distribution Via Browser-in-the-Browser Kit

Unit42 From Palo Alto Networks has discovered a Browser-in-the-Browser BitB campaign specifically tailored for malware delivery...

YARA-X 1.19.0

YARA-X is a re-incarnation of YARA, a pattern matching tool designed with malware researchers in mind. This new incarnation intends to be faster, safer and more user-friendly than its predecessor. The ultimate goal of YARA-X is replacing YARA as the default pattern matching tool for malware...

MAL-2026-6357 Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

darknet-mcp-server

English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Fr...

Malicious code in ts-bn-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8847a06a4d25b751ec7d33732a23324a42d7b2775ce441811623500b7b60f267 Package masquerades as a TypeScript lint helper but ships a credential-harvesting payload in index.js. The exported fromstr recursively walks...

Malicious code in @muaththir/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66954b91179d60bfbf1c18e8ed8ed9e6b12ab7b13bc6ab2a4174c3bf063c2c0a On npm install, the package's preinstall lifecycle hook runs node index.js, which collects host identifiers os.userInfo.username, process.cwd, Node...

Malicious Package

Overview backoffice-charges-module is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-6328 Malicious code in @muaththir/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66954b91179d60bfbf1c18e8ed8ed9e6b12ab7b13bc6ab2a4174c3bf063c2c0a On npm install, the package's preinstall lifecycle hook runs node index.js, which collects host identifiers os.userInfo.username, process.cwd, Node...

MAL-2026-6324 Malicious code in web3-crypto-address-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cd7750ff28e527c0a147330b21275364e997713a22a026e74dffb81cb9b123 [email protected] advertises itself as a multi-chain wallet address validator but ships an active crypto stealer that fires automatical...

Inside the dark web: Stolen identities for 95¢, malware, and scams-for-hire

Most people have heard of the dark web, but few understand what it actually looks like or what goes on there. To separate fact from fiction, our research team spent 48 hours exploring it firsthand and documenting what we found. The dark web isn't inherently bad. It also serves legitimate purposes...

MAL-2026-6336 Malicious code in sync-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc297a0deaba794fdbfccc280a79c7cc895f21fc4e0122b1fba1bc4759b66c3f The package ships an obfuscated JavaScript file at shim/index.js using hex-style identifier mangling 0x391f3f, 0x3eff0a, 0x534564, etc. characteristi...

MAL-2026-6333 Malicious code in mjs-eslint-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e95cb81c6a1238d751c013def46001948b388083e0d91f7baa5077091ae006 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6323 Malicious code in ts-sudo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a6e18b2d6bef04dd8377fac8d9b20e5545f1ec39875fdd308adf118b6f319d1 The package publishes under the name ts-sudo but ships a verbatim copy of the big.js v7.0.1 source big.js, big.mjs along with big.js's description,...

Malicious code in ts-sudo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a6e18b2d6bef04dd8377fac8d9b20e5545f1ec39875fdd308adf118b6f319d1 The package publishes under the name ts-sudo but ships a verbatim copy of the big.js v7.0.1 source big.js, big.mjs along with big.js's description,...

MAL-2026-6285 Malicious code in new-solt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a46a9516de2c87a2d451b78ace7033fb9dffa9faa4216b84eb068136098cfa Package [email protected] contains index.js which imports childprocess and invokes execSync with bash and zsh shell strings around lines 315 and 331...

Malicious code in new-solt-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51a48524931e3ec3199917bed8d48e70c07bf91f4a0322a46926b7c1d98d8b3e index.js imports childprocess and invokes execSync with bash and zsh shells around lines 315 and 331. The shell-execution pattern alone is not...

MAL-2026-6283 Malicious code in new-ecro-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0826d146dbc513ac14f403eaa9ba65dffbd04da52c55ff1840ad153dab96e87 The package publishes verbatim big.js v7.0.1 source including the upstream copyright header, README, repository URL pointing to MikeMcl/big.js, and t...