MAL-2025-352 Malicious code in no-style-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9044d80b8ff33b0d2a50511386c0fed003004f9452211938b949aca211b0866 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-323 Malicious code in mathworks.github.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32e52ada951c82ef138dcd96976a00cb9d2e1c15f171f1b3c4768a030075bba3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-147 Malicious code in testpacke (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38b837aa65eec730e3f6478200b0f279baef7aab09893e795b1173e13a686837 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-146 Malicious code in showcase-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72fdeda4a40b1170fc3888255d22ac1cb9cfe37834663d8a5812539c21e7c8e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-145 Malicious code in chipped (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8b4d484b6a0b05dde597bbc9ba800eec0c201e3fc81387511d009ae01d5e07b3 The OpenSSF Package Analysis project identified 'chipped' @ 1.1.0 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2025-143 Malicious code in bridge-transaction-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db5956f81e131c01814a55fa4294eec8b2c4a0a037934a273bcefad48aca0599 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-139 Malicious code in snapon-imageviewer-lw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7053e8d93acd05ac2454f25c628ab30c641d481373e8f20a08b28a0f66e1fe38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-134 Malicious code in dbximgs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a752546905d1373f7b092a98454b7ca4e820bebecb1af358ce0a6a72fa9a1e8 The OpenSSF Package Analysis project identified 'dbximgs' @ 2.0.0 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2025-73 Malicious code in utf-cleaner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 09b9e5c5deafbf756df5201976fdbdc3c61c10e815234df9aeb32764a3cd9652 During import, the package silently downloads and executes remote code. This code starts a web server in the separate process and listens for commands to execu...

MAL-2025-38 Malicious code in alchemy-web3-webpack-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0baf7db6925882a96eddaa00b4877f9147183d9b00a85fd69b02e5fe625f7ff7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-37 Malicious code in shopify-ecommerce-shopping-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a28c4bb6f1ccd57758357f7949eda10b66b8dcc6c7249a4b0756f28d5517369 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-34 Malicious code in @shadowbyte/checkout-telemetry-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3309a46cb7d7602b6b36a782d12752e0b69f409896afc9dd2d9fa4925d65b4a6 The OpenSSF Package Analysis project identified '@shadowbyte/checkout-telemetry-agent' @ 1.0.4 npm as malicious. It is considered malicious...

MAL-2025-33 Malicious code in pre-commit-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3f86360c5d5f5979a278474cb95f178bed388a7ce152931eee872318ac5fcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-32 Malicious code in hts-open-dex-react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71bfac5a5597cde45524360e887ab5bed0c9e5b8c5337ac9c0728b677529de56 The OpenSSF Package Analysis project identified 'hts-open-dex-react-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-31 Malicious code in innocent-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6fc7d792ebeefb0b83aeaecc6964d6288dced704804e70e6d7531b6a6dffc4a2 The OpenSSF Package Analysis project identified 'innocent-package' @ 1.0.3 npm as malicious. It is considered malicious because: - The package...

MAL-2025-27 Malicious code in cursor-always-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 614a7726e7b2899695d56d3b75f1f9179a6fcde5654913693b20e521e476840f The OpenSSF Package Analysis project identified 'cursor-always-local' @ 1.0.2 npm as malicious. It is considered malicious because: - The packag...

MAL-2025-26 Malicious code in @patternfly-v5/patternfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b43e835ee1484fff5f40f97988af91cf9adfabcef41f9bd4970a9eee273ee7ba The OpenSSF Package Analysis project identified '@patternfly-v5/patternfly' @ 1.0.2 npm as malicious. It is considered malicious because: - The...

MAL-2025-21 Malicious code in tree-sitter-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbacf70d3997892f49d729cbc0db29837ec65744402a0ae0c62460813e7f254f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12137 Malicious code in proton-parking-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 506697cca5654bda57571824a1c769ba976811a08a53a12e057f80fac4a610a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12131 Malicious code in contentsdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d682572d937337218240c73c90b9b0b4245feb639e633225bb21bf8f5fc32f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...