629288 matches found
Malicious Package
Overview @versacode/baileys is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of th...
Malicious Package
Overview uol-simple-api-futebol is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances o...
Malicious Package
Overview express-session-timer is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of...
Malicious Package
Overview file-type-detector is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of th...
Malicious Package
Overview reactlogo-load is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...
Malicious Package
Overview @umschool/analytics is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of t...
Malicious Package
Overview unifi-credential-server is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances ...
Malicious Package
Overview py-devoli-common is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...
Malicious Package
Overview databricks-webapp-navigation-homepage is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all...
Malicious code in easypanel-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb103b6863369372ba8c07701264f8b0f6b57e3217e07912c8efbd9371c648f The package's preinstall lifecycle script preinstall.js executes automatically on npm install and collects the installer's hostname, OS username,...
MAL-2026-16071 Malicious code in cat-sis2go-utils (npm)
cat-sis2go-utils is a dependency-confusion package published against the SIS2GO namespace, with versions inflated to 99.0.0 and 99.1.0. It ships no library code index.js is an 87-byte stub, and package.json declares both preinstall and postinstall running node scripts/run.js, so the payload...
Malicious code in easypanel-deploy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8 The package's preinstall lifecycle script runs automatically on npm install and collects installer-side identifiers — os.hostname,...
MAL-2026-16074 Malicious code in easypanel-deploy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8 The package's preinstall lifecycle script runs automatically on npm install and collects installer-side identifiers — os.hostname,...
Malicious code in easypanel-api-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cef6da51fcc215c514680417cfd3bacb5725b91a5b4a058fd6d2b161106209b0 The package ships an empty library body index.js exports and a preinstall lifecycle script that runs automatically on npm install. The preinstall...
MAL-2026-16073 Malicious code in easypanel-api-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cef6da51fcc215c514680417cfd3bacb5725b91a5b4a058fd6d2b161106209b0 The package ships an empty library body index.js exports and a preinstall lifecycle script that runs automatically on npm install. The preinstall...
CVE-2026-87735
An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption...
CVE-2026-87734
An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service...
Malicious code in reactlogo-load (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...
CVE-2026-87732
An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticatedecryptinto and Chacha20.authenticatedecryptinto functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false,...
