MAL-2026-11427 Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5 The OpenSSF Package Analysis project identified 'pp-react-worldready' @ 1.0.0 npm as malicious. It is considered malicious because: - The packag...

MAL-2026-11119 Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 63ee08885a126855fbc96dbbb6f8c4ef903d9dc8f2cb02fe0fa178a7db1ed904 The OpenSSF Package Analysis project identified 'json-to-table-util' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2026-11070 Malicious code in whs4_deu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 96d7709dc56eae4bfe07031da42425b4a94a169255cd7b3bde0f31f0516e0fb0 The OpenSSF Package Analysis project identified 'whs4deu' @ 1.0.1 npm as malicious. It is considered malicious because: - The package communicat...

Malicious code in identityscimapiserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c77102d108de4236b5ff8d121143aaa19efde51a10e4f63a6f79ad2dc982c34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-member-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f87897415ac7cb1f40cf896ec879d2a71a642d3361935df0758944a34389b13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11060 Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b44787fd6b711e395dc87ae7f5235d0e80d5591a925f9149319aa7d6ba3f0f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b44787fd6b711e395dc87ae7f5235d0e80d5591a925f9149319aa7d6ba3f0f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11062 Malicious code in preferenceslifecycle-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8741695d3ce21420a88f903f03c16da4621561d07117127b656f91488c9b58f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11056 Malicious code in gpaas-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04c01a5b087d1c4d6ae8700fd1fee92cdb45c5a77f59a62723b17b5aa43e7f5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32d630492188c1db46669f68ec67e108a452a185dceb46b7fd0cb3bc939e865b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...

MAL-2026-11020 Malicious code in hardhat-gas-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bc0a3828194aac457c89426a616772e54d6aa3868e1b0980b3e31bbbb20808c9 The OpenSSF Package Analysis project identified 'hardhat-gas-tracker' @ 1.0.1 npm as malicious. It is considered malicious because: - The packag...

Malicious code in react-tabulix-extended (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...

Malicious code in react-tabulix-virtual (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbfc5a819e6dfbc3c65ec83a79a9f93a95da71259279c54e95f34c36ab81a22f The OpenSSF Package Analysis project identified 'react-tabulix-virtual' @ 0.1.1 npm as malicious. It is considered malicious because: - The...

Malicious code in react-tabulix-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7304f03532008ba586815d08fdfa9fabde3615481804901bf96cba75fa38a1bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10775 Malicious code in n8n-nodes-devops-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b Package masquerades as an n8n community node package.json declares n8n.nodes: "MyNode.js", a trivial placeholder while index.js contains an unrelated...

Malicious code in n8n-nodes-devops-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b Package masquerades as an n8n community node package.json declares n8n.nodes: "MyNode.js", a trivial placeholder while index.js contains an unrelated...

MAL-2026-10777 Malicious code in n8n-nodes-probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4f7894dfb68e5ecea4e4325070ef0603662078212a48b789efc4b4e685b440e The package presents itself as an n8n community node MyNode.js exports a trivial no-op Probe node, but package.json main points to index.js, which is...

MAL-2026-6972 Malicious code in @vwfs-its/sf-sac-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41fd62df844e3fba17cb6200b0c9f2ce518a630677ed96f4cf0349b2a3eb7a3d On npm install, the package's preinstall hook node index.js collects installer host identity — hostname, OS user info, output of whoami and id, shell...

Malicious code in rio-design-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed72d8256a1831ef61f01d101c9b9de21db822516cb3b61d1fffd1ef7b3bb0c7 [email protected] is a dependency-confusion attack package. package.json declares preinstall: node index.js, so npm install auto-executes...