Malicious Package

Overview twork-data-services-sme-operations-authorizations is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview tinkoff-statist-browser-typed-client-sme.rko.ta.ios.events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection betwe...

Malicious Package

Overview vortnode is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview twork-data-services-getting-arrests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

ROOT-APP-NPM-AIKIDO-2026-554041 AIKIDO-2026-554041 in crypto-js - Patched by Root

Root has patched AIKIDO-2026-554041 in the crypto-js package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27977 CVE-2026-27977 in next - Patched by Root

Root has patched CVE-2026-27977 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27980 CVE-2026-27980 in next - Patched by Root

Root has patched CVE-2026-27980 in the next package for Root:npm. Multiple fixed versions available...

Malicious code in polymarket-stake-mathss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef71354e27f0e5798fee884366776d5b76ba0df0122148d1f4f7aeeef42b45cc Typosquat of polymarket-stake-math double s. The postinstall script install-check.cjs resolves a bundle URL from the package.json homepage field...

Malicious code in @ssgw/icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9d2fb7b19baedba9c5350b19ebf8ab3e99be16bd04fd15a3960889766ed97e70 The OpenSSF Package Analysis project identified '@ssgw/icon' @ 9.999.999 npm as malicious. It is considered malicious because: - The package...

MAL-2026-13684 Malicious code in @ssgw/icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9d2fb7b19baedba9c5350b19ebf8ab3e99be16bd04fd15a3960889766ed97e70 The OpenSSF Package Analysis project identified '@ssgw/icon' @ 9.999.999 npm as malicious. It is considered malicious because: - The package...

Malicious code in test-noexist-xyz-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6984c0cfd599175b528146e9bddb0ef6ad0ef07a21bc7dd78e6bdb195bd53d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

MAL-2026-13669 Malicious code in specials-resources-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07bd295669162565e4b75a82a674ae4ee555bd6e5bd1fab67de3093de939ea30 [email protected] is a staged remote-code-execution dropper disguised as an 'Analytics SDK'. Both the package main lib/telemetry.js an...

MAL-2026-13629 Malicious code in @coralxyz/anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763 Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor hyphen removed. The npm postinstall hook,...

Malicious code in map-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4 On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x8664 binary dist/internal/calc-math.dat as a detached background process. The...

Malicious code in sme-rko-finance-front-operations-other (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c11dc6f375e9ceaee8f1b8e40db07f49c88e7bc47715759b101d3513399047be On require/import, init.js selects an OS/arch-specific binary and downloads it from a rotating set of Cloudflare Workers hostnames...

Malicious code in sme-rko-finance-front-operations-holding-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6838cce82eaa89f91af46e82f5153f7318dafd0ebccb4bdbb6251114d95ff51 On require of the package, shim.js executes a bootstrap at module top level that fetches a platform-specific native binary from...

MAL-2026-13662 Malicious code in sme-rko-finance-front-payments-feed-display-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eedf1850bd0f58b8adef8a6b6c3ac13adf7848819306e5a7b9518cbb174911a3 On require of the package's main module, compat.js unconditionally downloads a platform-specific executable and runs it. Destination hosts are...

Malicious code in sme-rko-finance-front-payments-currency-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c602d22e5a0f1d7cee18a98a7ce0b67e2c8440f7ff95330cb6c33d169f2e629 On require of the package, index.js loads support.js and lib/telemetry.js, both of which reconstruct the identifier 'childprocess' and destination...

Malicious code in sme-rko-finance-front-operations-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd5c58bd9b678ac91c87dbb7f9a1d2318c67cd3754d643550c7674c903186de On require, this package loads ext.js and lib/telemetry.js which fetch a platform-specific opaque binary from a rotating list of attacker-controlled...