Malicious code in 3layerdipstackmokfkh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da015575c29fe6af032ba0c966d1adcdab17b367ca32bfb54fb11bbcfa4d890c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack7lknl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6611ec62b6f8623df5dd819bb66d682635bcc9c5f0d3fa55a9d2b3ee05be07b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14616 Malicious code in 3layerdipstack3jen8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ab220f8a7f7f54199b53769a9b4a4ec083be096b613fd4aa01b6ab6a5e789c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack8nvcr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 31bd7567852a3ab3dea796ef6b4c8d39752b2e20a8f3c7381c8662dedbff2f80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in waxed-slightly-weathered-cut-copper-stairs-f90oqwwm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c437b8c3548015457571f8b8996cac9b3f9be9d71bfe27b50cfc9df52517f2c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15092 Malicious code in classlink-idih6eh4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12e51eaef373af0dded182557c5e52ee70eb0f184aea4cbb11baf37c08a9530c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-tbq8gn8g (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87dd283be1677692bf35446cea3a62ed1fbb36f17a8242c49d832b26fdc81bf7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-idih6eh4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12e51eaef373af0dded182557c5e52ee70eb0f184aea4cbb11baf37c08a9530c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15056 Malicious code in classlink-co3ghhbr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 012ebab64d413e843b2fb7e2be2353a65fb81d8ab6e0dfb0cae7f8191db96925 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14578 Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

PT-2026-71690

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

VulnCheck KEV: CVE-2026-73532

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

MAL-2026-11332 Malicious code in model-data-cache-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a5f728ad2fff044db6b02073523084d299a7e876770118b7c0a097ffd904c4f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sixbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91338e6d735e538b7defb669e5b213cad127a9fd64290fa32d83bb855dcf9bd sixbails is a WhatsApp Web library Baileys-family fork. On every socket creation — the package's primary documented API — a 5-second timer fires...

MAL-2026-6851 Malicious code in metrica-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acc9d835dca527dc5e6db2124ca93898cd3f4f8bf0b6589a60c0eceed23314d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5996 Malicious code in @mastra/agent-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ba6a41e7e43733a8334968ce740af8771208c66c7529d9f4319bd62e39601d @mastra/[email protected] declares a dependency on 'easy-day-js@^1.11.21' in package.json, but the package's own compiled code in dist/index.js nev...

Malicious code in crypto-promise-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00594a3ae015e55e13c94c904866eae7b86a39b904b2d79469c4b59508c3918f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3.prc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6db6feb92bb662bbf24ea3769595c836f3443f8fb33833b094134f294704af70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4308 Malicious code in core-utility-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf63d686ef961c38d281d369f2f1b2cf4e2baf9c25f3e6a62672a9ac9b979963 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @antv/gi-sdk (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...