Malicious code in prism-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6570c9056bf020fdada0366045c4e91a0f5cb21171fe27df9fcea82259e7809 The package declares preinstall: "node index.js", which fires automatically on npm install. index.js collects host identifiers os.hostname,...

Malicious code in deepface-weight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...

Malicious code in vite-svg-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f The package's exported getPlugin/setPlugin functions decode two base64 constants svgValidateKey, svgValidatePattern at runtime. svgValidateKey decode...

MAL-2026-14133 Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

Malicious code in infogram-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08547edeec8e522d84b40fd8236878da54c888ede86588be3913a1c37cd2b245 [email protected] implements a Telegram bot that accepts text messages from remote parties and passes them directly to subprocess.checkoutputcmd,...

Malicious code in httpz-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 004770b4da0c6705f95ef2c8654fd81d37650ffacaad7160041bded02cdb7fbc httpz-requests exposes a Telegram bot startbot, runcmdenc, httprequest whose message handler executes arbitrary shell commands on the host running th...

Malicious code in plugin-react-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c068ede55759ccbff349be0990eab7756ca43a5eed8a60a805e69e8c32626a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14125 Malicious code in @guildai-services/guildai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd47a423c934111e427e5db6e85d5f4393272e0a662818840887dffe409f1c21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @guildai-services/guildai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd47a423c934111e427e5db6e85d5f4393272e0a662818840887dffe409f1c21 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @reducers/projects (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88c280d6ec5724de44b3fafa7041f34d91e7896741e211cfc0419a1b84c6e241 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14127 Malicious code in @reducers/projects (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88c280d6ec5724de44b3fafa7041f34d91e7896741e211cfc0419a1b84c6e241 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14126 Malicious code in @milleree/date-display (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2c195a06ca2577f279d5ec0939d9d958086f361f147e08b200c28786f776ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @milleree/date-display (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d2c195a06ca2577f279d5ec0939d9d958086f361f147e08b200c28786f776ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in motionspring (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d5f88ace3511b8bc1e45478ab620bdf9fead63cf9e3a1ef19e4b815093d698b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14124 Malicious code in alphazone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fd365bfb46c45371bec3fb53e2e37be369a42ac12a10b3c8ca6ffec7dc604bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alphazone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fd365bfb46c45371bec3fb53e2e37be369a42ac12a10b3c8ca6ffec7dc604bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-20348 affecting package clamav for versions less than 1.5.4-1

CVE-2026-20348 affecting package clamav for versions less than 1.5.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-20337 affecting package clamav for versions less than 1.5.4-1

CVE-2026-20337 affecting package clamav for versions less than 1.5.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-20339 affecting package clamav for versions less than 1.5.4-1

CVE-2026-20339 affecting package clamav for versions less than 1.5.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-20338 affecting package clamav for versions less than 1.5.4-1

CVE-2026-20338 affecting package clamav for versions less than 1.5.4-1. An upgraded version of the package is available that resolves this issue...