Malicious code in patchwork-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9 dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference line 286, matching a...

MAL-2026-10721 Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

MAL-2026-10719 Malicious code in @thepayulink/server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0f04014bd624dc0712b8bfb78c53832ef18bf6a178d462b1959df9a8b81ec94 The CommonJS bundle loaded by require'@thepayulink/server' dist/payulink-server.cjs hardcodes apiBase to https://eliteyatra.vip as the default...

Malicious code in @yeaft/webchat-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b627f9a4ff0aaacfcd612224f76fe679e9d0a04578519d75516136e7496aad43 The package installs itself as a user-level service systemd on Linux via service/linux.js, with launchd/PM2 siblings and, at agent startup, opens a...

MAL-2026-10757 Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...

Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99621af0900df34246c87811ea5c2a643f2b3805601136dcc0a6768e48af925f The PyPI package captcha-solve-api contains no captcha functionality and is instead a binary dropper disguised as an analytics SDK. A custom setuptoo...

MAL-2026-10755 Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99621af0900df34246c87811ea5c2a643f2b3805601136dcc0a6768e48af925f The PyPI package captcha-solve-api contains no captcha functionality and is instead a binary dropper disguised as an analytics SDK. A custom setuptoo...

MAL-2026-10747 Malicious code in sensorium-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73c4ac95caf91cb047bab32d5202efa2dfc2e4f84a032160419a7c30739da91c sensorium-mcp starts a background poller against api.telegram.org/getUpdates and delivers received message text as prompts to locally spawned Claude...

MAL-2026-10732 Malicious code in hehehe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 588dd776720f805d7d84a58c93ffcd21ed860e3fc21a48787d732eb6180b974d Package is published as an 'enterprise Windows Diagnostic Utility' but is an anti-proctoring cheating tool that also steals the installer's browser...

Malicious code in @onescience/onecode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 713bf7fce40e177608dd5145e1662b4efd3da6c1597d9a1aeb15d7715b865205 The npm postinstall hook runs ensurePlatformBinary, which downloads a.tgz archive from the hardcoded bare-IP URL...

Malicious code in @agent-link/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912 The package's runtime connects to a hardcoded WebSocket relay default wss://msclaude.ai and dispatches messages received from that relay directly int...

@whalent/agent (0.3.289) potentially affected by unknown CVE via @whalent/agent-core (0.3.289)

@whalent/agent-core NPM version 0.3.289 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.289 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.258) potentially affected by unknown CVE via @whalent/agent-core (0.3.258)

@whalent/agent-core NPM version 0.3.258 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.258 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.245) potentially affected by unknown CVE via @whalent/agent-core (0.3.245)

@whalent/agent-core NPM version 0.3.245 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.245 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.240) potentially affected by unknown CVE via @whalent/agent-core (0.3.240)

@whalent/agent-core NPM version 0.3.240 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.240 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.294) potentially affected by unknown CVE via @whalent/agent-core (0.3.294)

@whalent/agent-core NPM version 0.3.294 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.294 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.254) potentially affected by unknown CVE via @whalent/agent-core (0.3.254)

@whalent/agent-core NPM version 0.3.254 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.254 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.265) potentially affected by unknown CVE via @whalent/agent-core (0.3.265)

@whalent/agent-core NPM version 0.3.265 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.265 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.263) potentially affected by unknown CVE via @whalent/agent-core (0.3.263)

@whalent/agent-core NPM version 0.3.263 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.263 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.232) potentially affected by unknown CVE via @whalent/agent-core (0.3.232)

@whalent/agent-core NPM version 0.3.232 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.232 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...