Malicious code in simple-date-formatter-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e828348e997bf53071c8bc1d24adc305be689a64a56f2ababda6ef9370948d3 The package appears to be a small date-formatting utility. No credential access, no install-time or import-time network activity, no lifecycle script...

no-gdid — Updated!

no-gdid Read, understand, and silence the Windows Global Device Identifier GDID — the hidden per-account device ID that helped the FBI locate a suspect who was using a VPN. ⚠️ Honest disclaimer up front: this tool does not erase your GDID and does not make you anonymous. The GDID lives on...

CVE-2026-67327 better-auth before 1.6.22 Account Takeover via Magic-Link Email-OTP

better-auth versions = 1.1.3 and = 1.7.0-beta.0 and 1.7.0-beta.10 are vulnerable to account takeover via pre-account hijacking on magic-link and email-OTP sign-in when open email/password registration is enabled. An attacker registers an account with the victim's email address and an...

MAL-2026-11491 Malicious code in test-dev-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b3df759cd11b9c662bed5840b0671d4e9c54a76a606d284ca39390ecf51f8d [email protected] connects out to a hardcoded socket server host/port sourced from the test-dev-config module and enters a receive-loop that...

MAL-2026-11492 Malicious code in test-dev-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4f4885b543da795140d0ac9c44423c6ecadf74c744c1f322f9d1a5263fe4f2 No static or traced behavioral signals of supply-chain attack were observed in this package. There is no evidence of install-time or import-time code...

Malicious code in @spending-behavior-ui/widget-insights (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36bbaed8e8bd830b00f14eaeb532fbeeb0d581a806dbdbca220ab006b1adc958 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11449 Malicious code in @sof-assistant-fe-lib/vertical-faqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d1ba538ee75936802bcb54b49dd258a1941bf7b9f07bc0b05db81fd656c47e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11466 Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...

Malicious code in adpanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e99205329e726e32ed6884b52666e69e3327134c257dd1025464fed2fb461bf lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, reads local files via fs.readFileSync,...

MAL-2026-11481 Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...

monitor v0.34.0

BetterDB Monitor The monitoring layer that Valkey deserves. BetterDB persists what Valkey throws away - slowlogs, command patterns, client activity, anomaly signals - so you can debug what happened at 3am, not just what's happening now. Built for Valkey 8.x with native support for COMMANDLOG,...

MAL-2026-11417 Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...

MAL-2026-11416 Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...

Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

MAL-2026-11419 Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...

Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...

MAL-2026-11414 Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...