MAL-2026-11459 Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1017256693a94381e0b07af053580670a0cd8b3e5868954aba49474d32cd8c18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11464 Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49a563cc12f897dc708236d0098fa2cedfeb15e249d23879b5c0e279e353604c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11471 Malicious code in maximumsats-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97f5b15159d700da1bba2acd235f675c5ef09636644f47b105ccd48648c9b845 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11032 Malicious code in chai-as-stringify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06bb8071b2894038268bb513310437eed2c6ffc3aa534c8fae8b8273d7f56a9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11014 Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5db4f6fb4cd8bc8073e03771776ba865f51f852120bd44162573774905ccf22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11010 Malicious code in calvora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d42150b238e61e7ade93da3750393fdd09523b36d5794ed80e57c6a183029a66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content

When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup DeleteCollaboration removes the collaboration record, recalculates accesses, drops watches, and unassigns issues — but it...

MAL-2026-10815 Malicious code in @gocortexio/npmgremlinbox-copyleft-next-0-3-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf6ed48efe682ebb1ee6a19edd4529a25aed3c46f8fb6686228de074a424a4a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10829 Malicious code in @gocortexio/npmgremlinbox-lgpl-2-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57c01ac5110fda0b2a3a6bf1ee06fb637561e65d36e549ed3d2bc355183185b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10786 Malicious code in @gocortexio/npmgremlinbox-agpl-3-0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d09dea814f5a87e5e45c7bc9e94fe14fa4c70eda3037e2876ae0e92d10d0961 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10773 Malicious code in telemetry-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15daf7bcf2af06908cb74f81166241c5c3534e75c609204e81b984f6cd3ee867 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10598 Malicious code in monitoring-service-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb0e7dea7e0302bc22488fbaf436dd36c0763f05ef494977822e8a1b7b3a1ab The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10558 Malicious code in akshajrawat.utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 105157af41712b64f8b36ec1cb01e28958e4ad828a0c08d0979a1f6e22d1f13d The package's package.json declares a postinstall lifecycle hook that runs automatically on npm install: node -e...

Malicious code in sight-bind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398788014436c7e95df3045f9b32398c3de46b8c9275c0437e44bda1dcb6cc00 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @gleamkit/engine.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 008464ca4d7ba15b4b8c6d3a979586c61bd527aef3a209571d28c0ba912403ae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in testdonotredeemit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9f9461b13f64b90e569dcc6354708559128c23f4e47e4ac5842b46ce0fb6ed2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in nottuff30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4a979285347756e69976ca9775cf22e923002ec93ede98adc0dccd7999ea087 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in ishowfeet20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57470f610cd7e988daef50a3a2587778f3dce2cb1584572d4a1795876f9cf6fe The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec6b68489cb95001c5971ace33533e31169126fb141feea65e198756e66c05c The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...