Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27 The package declares a preinstall lifecycle script that executes index.js on npm install. index.js uses childprocess.exec to run a curl command whose...

Malicious code in oce-configurator-wireless-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191e4a78bf46781b56b290aac7b804fd9470b1ac189896b950afbaba548183e6 Package name resembles an internal Swisscom OCE package and is published at version 9999.0.0 to win resolution against a private registry. The...

MAL-2026-15909 Malicious code in 1nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43 Package name typosquats nestjs and declares postinstall: node index.js in package.json, so index.js runs automatically during npm install. index.js...

MAL-2026-14443 Malicious code in @elc-online/up-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e659619abda05c9d3835997471d962784e947fd65960e24146082b596d015d6e The OpenSSF Package Analysis project identified '@elc-online/up-analytics' @ 99.99.99 npm as malicious. It is considered malicious because: - Th...

Malicious code in dpg-media-7ehemel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594 npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment...

Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

MAL-2026-14361 Malicious code in stillm4ddpocs-demo-gadget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff42d765d0c2f6af53e4be5a9cf26ef34b3a36accf199acfb7d53af40b8dc2a6 On npm install, the declared preinstall script runs index.js, which collects the installer's hostname, OS username, home directory, cwd INITCWD of th...

GO-2026-6213 vulnerabilities

Vulnerabilities for packages: skaffold, kubevela, argocd-image-updater, pulumi-kubernetes-operator, goreleaser, gitea, gptscript, steampipe, kyverno, pulumi, grafana-alloy, gitsign, src-fingerprint, scorecard, pulumi-language-dotnet, pulumi-language-yaml, grype, rancher-fleet, act, trufflehog,...

MAL-2026-14123 Malicious code in @oyo_tech/oyochat_user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2211869e361bf0cd90956a5c1dae972927c25c1d52e5ed4729cddc7b67fe682e @oyotech/[email protected] is a dependency-confusion probe. package.json declares a preinstall script that runs node -e...

GHSA-HJCP-JMPX-G3QM vulnerabilities

Vulnerabilities for packages: logstash, apicurio-registry, flyway, nrjmx, cloudwatch-exporter, sonarqube, kserve-modelmesh, cassandra-reaper, thingsboard, trino, wavefront-proxy, zipkin, opensearch, akhq, druid, dependency-track...

MAL-2026-14053 Malicious code in depcruise-baseline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c [email protected] has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as ...

GO-2024-2472 vulnerabilities

Vulnerabilities for packages: xeol, xeol-fips...

GO-2025-3678 vulnerabilities

Vulnerabilities for packages: lychee, sccache, wadm, wasm-pack, wasmtime, ztunnel, zizmor, tealdeer, kdash, fnm, pixi, xh, nushell, wash, rye, buck2, linkerd-extension-init, wasmcloud, oranda, parseable, samply, shadowsocks-rust, zed, cargo-audit, atuin, rustup, zola, ntpd-rs, deno, uv,...

GO-2025-3563 vulnerabilities

Vulnerabilities for packages: buildah, kubescape, splunk-otel-collector-fips, conftest, containerd-fips, age-fips, kube-oidc-proxy, prometheus-mysqld-exporter, rabbitmq-messaging-topology-operator-fips, agentbeat-fips, newrelic-nri-statsd, git-sync-fips, bazelisk, conftest-fips,...

GO-2024-2472 vulnerabilities

Vulnerabilities for packages: xeol...

GO-2025-4014 vulnerabilities

Vulnerabilities for packages: vertical-pod-autoscaler, terraform, envconsul, vault-k8s, spark-operator, dbmate, cadvisor, pulumi-kubernetes-operator, xcover, local-path-provisioner, step-kms-plugin, portieris, nfs-subdir-external-provisioner, podinfo, rootlesskit, sealed-secrets, slsa-verifier,...

MAL-2026-13684 Malicious code in @ssgw/icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9d2fb7b19baedba9c5350b19ebf8ab3e99be16bd04fd15a3960889766ed97e70 The OpenSSF Package Analysis project identified '@ssgw/icon' @ 9.999.999 npm as malicious. It is considered malicious because: - The package...

Malicious code in trezor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 744ba5806b927aefbdd505acb44fb77a23bb71570d27d1ba17ec7642dcf17383 [email protected] is a Trezor-lookalike npm package whose index.js, on first require, harvests installer-side secrets and posts them to a hardcoded...

Malicious code in hwi-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 687b96d2fb386735a783701f54b1740fad0e16e1dc153ebcf7f07dd5506d23db [email protected] ships an empty index.js and a postinstall script that runs automatically on npm install. The script reads installer credential files...