42705 matches found
Malicious code in govapkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...
CVE-2026-44909
creationtimestamp| type| source ---|---|--- 2026-07-23 18:10:43+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrdgqdqney2c 2026-07-23 19:42:40+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrdluqw6m72f...
CVE-2026-65537
creationtimestamp| type| source ---|---|--- 2026-07-23 14:44:45+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrd3a2mgit2y...
CVE-2026-9264
creationtimestamp| type| source ---|---|--- 2026-07-23 12:33:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrctusfvqj2c...
CVE-2026-21723
creationtimestamp| type| source ---|---|--- 2026-07-23 04:04:27+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrbxh45kxz2u 2026-07-23 23:55:20+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116971989915718782...
MAL-2026-11030 Malicious code in vitest-axios (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5309dc413289d10c8d1cf1b2593f5e29c7810c23f60cb8e2c7709884cdba4c04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11024 Malicious code in create-kumo-project (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0ae70168cf816c36428f7c33d9beff0f159fbc6cd23b66eccc375e94aae4985 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11012 Malicious code in encryptstringadmin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e862c6a1d5cf9a77c2060f767e7144e9a73b77913c801dbf23f571ca5d3e054 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10994 Malicious code in app-data-ist (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...
MAL-2026-11010 Malicious code in calvora (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d42150b238e61e7ade93da3750393fdd09523b36d5794ed80e57c6a183029a66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11019 Malicious code in veskr (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af373607b79177ffadde79de1f78b4c5490a04cc5cdf41a925cf42e234fc867a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11008 Malicious code in caldryn (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c9fe8dc148d9aeea38bde81a4c2c467769c550580a8394dbbef1152aea36ca6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2026-61391
creationtimestamp| type| source ---|---|--- 2026-07-22 15:15:31+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrami5nycm2j...
Malicious code in streak-daycount (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5a02c91969e01fc57050b8fabfc6abe2e50b9455cdaa4357791d24546b5623a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10981 Malicious code in streak-calendar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
CVE-2026-16408
creationtimestamp| type| source ---|---|--- 2026-07-21 14:11:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5yga5vpe2q 2026-07-21 14:12:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5yj722mj2u 2026-07-21 21:00:06+00:00| seen|...
CVE-2026-16445
creationtimestamp| type| source ---|---|--- 2026-07-21 14:08:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5yatv4py2e 2026-07-21 14:40:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr622tzdcl23...