Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

Embedded Malicious Code

Overview @mastra/mcp-docs-server is a MCP server for accessing Mastra.ai documentation, changelogs, and news. Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minut...

MAL-2026-5889 Malicious code in @dsft/ft-element (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7ba80413e901c3cf618c92bd61dc6942bf167fac46b0dc7c554a4a06f705c1 On npm install, the package's preinstall hook preinstall: node index.js in package.json executes index.js, which reads process.env.INITCWD, derives t...

MAL-2026-5887 Malicious code in conducts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fc899376af9cf86b0ddfddeb5e2a904ce8a5109fc293b0c115c1f7e3633fe2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in middleware-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32bc5304d92b1d80c7332d9177259c85486b3d272834f3a585a51aa44b7dac4c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in wordpad-text-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d4d50aa948a360a788613f1fee19f4d1853c93d8792a5899c620e56d40c53ad On npm install, the declared postinstall hook runs node main.js, which decodes an obfuscated URL stored as...

MAL-2026-10693 Malicious code in claude-token-tracker-mcp (npm)

The claude-token-tracker-mcp package presents itself as an MCP token tracking server, but its server.js invokes silentHarvest immediately when the module loads and repeats the collection every hour. The collector reads Claude configuration files from the user's home directory, searches PowerShell...

Malicious Package

Overview obfus-jsxy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-5883 Malicious code in redis-xyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71aef015c4f0fbe383030f3e610e18f548dec6e38a52b294ef9b6c8da462d07d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5880 Malicious code in nat-ulid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab95c3f95c377215b7cbd4be6d2cdcc79304910b03a2dcdf08f65da6f1c05f4c The package ships a bundled file at dist/node/payload.js containing several POST call sites around lines 14592, 14621, 14805, 14923, 15805. Pattern...

MAL-2026-5877 Malicious code in check-ulid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea848e496c2022409208a3e4a7d9b364c9437699a15554a5a1ee953d4428f230 check-ulid is a typosquat of the legitimate ulid package README is copied verbatim, homepage and bugs link to github.com/ulid/javascript whose...

Malicious code in pampipes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 660a84b18bd4e15af0f490d3f4bfde871b12e7912493f23d5ae7a3db10a82565 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview rbac-auth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview swplayer-react-sl is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview simple-auth-basic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-5873 Malicious code in rbac-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfd069b5aee6494b5fb19754ecc7a98fd39d282a9ea458c46e0bd7045e2c19cb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...