MAL-2026-10277 Malicious code in abuden28 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a58dd1a008e23641f5373b4593347947fb72a1a199e2354ffe75c79af4066d98 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10269 Malicious code in abuden228 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15ded0c14059932e82f8e56f2b6d6fb13ebe2da3b51d3e17e048044e9266716 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10263 Malicious code in abuden222 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c141ada78ccdede0bb49a76d998fcf07eb4cc60c58cce5fdc1b5933b85a817d The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10256 Malicious code in abuden213 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a014a046e0516c12f5b1d7dcebebc2451633c4987fd3c96aae43229501ede141 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10280 Malicious code in abuden4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c566b19e3b2fffddf78ea97e8aadc31f0e931f1bf708653194acaab8521283c The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10352 Malicious code in nottuff27 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b836372198329677623bb152dc7db76b249d842c0d10a3ec94d9ce2ae467827 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-6136 Malicious code in ratelimitsucks6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ebbee718bfa55eada8a2d56c9ea228e7b661364827e71995fd456027df7eedb The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Company that Secretly Records and Publishes Zoom Meetings

WebinarTV searches the internet for public Zoom invites, joins the meetings, secretly records them, and publishes alternate link the recordings. It doesn't use the Zoom record feature, so Zoom can't do anything about it...

CVE-2026-22040

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter, it is possible to reliably trigger heap memory...

Malicious code in @lokeswari-satyanarayanan/rn-zustand-expo-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73fe3bd99e2f11ab8bb09a9086c4dca8af56372031492ed11d90f1e32a0e8f53 The package @lokeswari-satyanarayanan/rn-zustand-expo-template was found to contain malicious code. Source: google-open-source-security...

Malicious code in @afetcan/storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4abbde27cce56326711e4e32f42572cb60977ca7ccce4ebf1fcfa558a847c1a6 The package @afetcan/storage was found to contain malicious code. Source: google-open-source-security...

Malicious code in @alexcolls/nuxt-ux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d0dc43ee3b9d8d19d3d6a710804c3ea65f07046818a98a58990901d8f88d77 The package @alexcolls/nuxt-ux was found to contain malicious code. Source: ghsa-malware...

Malicious code in @antstackio/shelbysam (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b11f3b36cf4d67018deed9546e206b16b8fa148a32c0802a5e8c51998f1c17e The package @antstackio/shelbysam was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b761a46dff9ea0ec6705cfe75221ceb7a3adeac0b4a2954618b3b069db3824 The package @oku-ui/checkbox was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/popover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b98eecbc4f662192c0aea469b5611692a9f412c082a230adfe80e142c6c0c3b6 The package @oku-ui/popover was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0711033d654f75b42d8959721555bcf5aa5fb766ccc12b6e89c56eef0d8cafd The package @oku-ui/portal was found to contain malicious code. Source: google-open-source-security...

Malicious code in @silgi/yoga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c8aabbdab5840682c4f335a1ae8ff93ff305af445e00bacb5f10b1fd85b7ba1 The package @silgi/yoga was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c31b6225a913c42ff3e119872d881af1992d5de51a2cf9632f3c055a8fd577c9 The package @voiceflow/common was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/voice-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79c5cf11d531645e24158300a51c4ed8ec4267e9b59051ff7f5266e5cdc593b6 The package @voiceflow/voice-types was found to contain malicious code. Source: ghsa-malware...