MAL-2026-10835 Malicious code in @gocortexio/npmgremlinbox-malware-cryptomining-indicators (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e17110b408450f798af7801913c4ae1a286a4d81496e15d1f79a94426d7ed3e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gleamkit/socket.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6a306142d74b2781d66322adf2bc1b9898bfdb8e1814d2cb511c3e49b75c13 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sixseven10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21936e53270838d4901646de1e1c3eef9212055032d3cead428cbf3bfd60b9ed The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

Malicious code in abuden229 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 348ad89821b1ea36a325bc8f2e570b3a74e3a6238381106746bc31146c743fec The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10394 Malicious code in vibewise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ac8cff44b5e6eda49cbb2c32a6333f5ff2d6910165abc081d1fe0d0bcf11118 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6835 Malicious code in es-lint-entry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7abab05be195342f311825ea394c11273032428d1bd122dd4fe31f8a5b8da554 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6810 Malicious code in chalk-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a36409ecc80ae4c159621da4530caf78fa06d5003dd2a55e18da3ae92b434cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6799 Malicious code in awesome-cli-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8126f65c2eaf406ae6c6510e03e8bbef8f243974be621b7e38a0c52d9e521a18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6639 Malicious code in @postman-app-monolith/renderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4ea9912817d4d94e8b97e2b588237f3f2cddc29058e81d8958ec78b4b90d961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6621 Malicious code in @flipbit2-bb/scope-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21b4b4d5e8e72141828bf6df5afe2300f5b9496d22f8b05491623fd699496603 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6412 Malicious code in nabisco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d0ed482ca35ed621384d6d91c398fe605352571a710d8f4222af056cedf48bb Package self-describes as a security PoC for dependency confusion targeting an internal HubSpot module name. On install, postinstall.js prints a...

Malicious code in @mastra/qdrant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56b9276df2c5f66da957d7e30e4ed702cba5053f80e1a9f715b016b2e66a043 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @tenforce/toolbox-fontmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc43bc0434418226ca77115c791ff0ea0031a0d314e73acfe0a62686528ceaad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5268 Malicious code in ulid-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3976f115506c13c7fae459afc6ad381e64043c4b8ca394a115763baa3d182c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5131 Malicious code in @redhat-cloud-services/sources-client (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

MAL-2026-5059 Malicious code in chai-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5110f40393583ef41ebcfa3558d782310a40a78227a040480d871c25311b79ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @trp-individual-investor-adv-disc/adv-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fc0ed55f4ec8a9ae7dd408c68635f245461c319bf4e7a0ca85adb25c9eb317b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @limebike/supreme-date-pickers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c82e94fac384ea6891e5aea99635ab429663e321502acbbc9eaaf81864e0d5e On npm install, both preinstall and postinstall hooks execute index.js, which collects the installer's hostname, all non-internal network interface I...

Malicious code in @squawk/mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed4b99ef5ac5fd4f25fdd4844c49a608343d6596def04cfb9df850c40e927dc9 The package @squawk/mcp was found to contain malicious code. Source: ghsa-malware 7d06b20db1195e1e5566e553087c2be971625c4a648e9cbfe5c1e0e836b93aa9 An...

MAL-2026-3013 Malicious code in undicy-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d4da47dd47cb80cf3a7a93cd81c2154b7cd905834b35f89f0703a5a8dab5d1e The package undicy-http was found to contain malicious code. Source: ghsa-malware daa1abf913048406268c31888f8b6defc0e69b49ba85dcbdb966fea8a3caf235 An...