Malicious code in dext-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329047f71cd6b35084bea7ed22978ba88e02cb557a5490b6133a70a5a0859a19 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @sdgdfgdfhhhfd/multiviewr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e2d548769641b2114a424739448d9df85d67cc176e694c6ff34ede446082b76 This package publishes a MetaMask snap that derives BIP44 entropy for coinType 60 Ethereum and transmits the resulting privateKey, publicKey and...

Malicious code in @sdgdfgdfhhhfd/chainvista (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf04f8e698eac423b3ba255617c60c9167b4b3453b7d73966ad62b02e0695a1 This MetaMask Snap derives BIP44 entropy for Ethereum coinType 60, Bitcoin 0, Solana 501, Cosmos 118, and Testnet 1 and POSTs the raw privateKey,...

MAL-2026-14359 Malicious code in internallib_v902 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6a70573af9e288e99418e904fac717ad03d8ed270aaa9e739e42d9ec1dac962 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

malvinci

malvinci Dieses einfache Skript stellt eine neue Art von Malware vor, die die Firewall deaktiviert, einen HTTP-Server startet, ihren Port über ngrok weiterleitet und die URL des Servers über einen Telegram-Bot sendet. Du musst einen neuen Telegram-BOT erstellen. Folge den Schritten hier, um einen...

Malicious code in tailwind-animate-css-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a4ac9c32887fff975dd06912302125d243af4f0bb2567714ef69ec763997e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14346 Malicious code in @next-fonts/font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...

Malicious code in @js-lib-team/env-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...

Malicious code in chai-as-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62 [email protected] is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelat...

Malicious code in reqcrypts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb4e239b6344dfe684483344d4d1a2da013a4d506b78d81e9096c6b31a690ae reqcrypts is published as a drop-in HTTP client import reqcrypts; reqcrypts.geturl but its RequestHandler wraps every JSON response through a...

CVE-2026-77651

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution...

Rust Supply Chain Attack Puts Build-Time Malware in Crates with 245 Million Downloads

The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are...

Malicious code in exam-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cd95c1b59238861675a30a947648a2280420c11e53dcb4f8501db5cb736313 On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../public/logo.ico, DES-decrypt...

MAL-2026-14331 Malicious code in exam-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cd95c1b59238861675a30a947648a2280420c11e53dcb4f8501db5cb736313 On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../public/logo.ico, DES-decrypt...

Malicious code in @pablo_clueless/printr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13ba2a3695f8d0fa63fb6558e66660f1e3b4a6f4eb080b86c486daae6f55102b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @pablo_clueless/sniffr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e53d0f446873ba82f5cec59baa471da44bedb5386ddae175b8b501b9b038240 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14329 Malicious code in @pablo_clueless/printr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13ba2a3695f8d0fa63fb6558e66660f1e3b4a6f4eb080b86c486daae6f55102b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14328 Malicious code in goldstar-api-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79d095fdd61f79c64b4b5d12ba75957b7c5de47df2bcfa549b05b23c7e450eba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in create-react-app-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7f200b99d8d2fadc13b72ccdd272107db79b8bc517ef5346a354479a177dff The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14324 Malicious code in create-react-app-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7f200b99d8d2fadc13b72ccdd272107db79b8bc517ef5346a354479a177dff The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...