MAL-2026-10263 Malicious code in abuden222 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c141ada78ccdede0bb49a76d998fcf07eb4cc60c58cce5fdc1b5933b85a817d The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10256 Malicious code in abuden213 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a014a046e0516c12f5b1d7dcebebc2451633c4987fd3c96aae43229501ede141 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10269 Malicious code in abuden228 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15ded0c14059932e82f8e56f2b6d6fb13ebe2da3b51d3e17e048044e9266716 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10277 Malicious code in abuden28 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a58dd1a008e23641f5373b4593347947fb72a1a199e2354ffe75c79af4066d98 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10280 Malicious code in abuden4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c566b19e3b2fffddf78ea97e8aadc31f0e931f1bf708653194acaab8521283c The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10352 Malicious code in nottuff27 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b836372198329677623bb152dc7db76b249d842c0d10a3ec94d9ce2ae467827 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-6136 Malicious code in ratelimitsucks6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ebbee718bfa55eada8a2d56c9ea228e7b661364827e71995fd456027df7eedb The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Company that Secretly Records and Publishes Zoom Meetings

WebinarTV searches the internet for public Zoom invites, joins the meetings, secretly records them, and publishes alternate link the recordings. It doesn't use the Zoom record feature, so Zoom can't do anything about it...

CVE-2026-22040

NanoMQ MQTT Broker NanoMQ is an all-around Edge Messaging Platform. In version 0.24.6, by generating a combined traffic pattern of high-frequency publishes and rapid reconnect/kick-out using the same ClientID and massive subscribe/unsubscribe jitter, it is possible to reliably trigger heap memory...

Malicious code in @lokeswari-satyanarayanan/rn-zustand-expo-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73fe3bd99e2f11ab8bb09a9086c4dca8af56372031492ed11d90f1e32a0e8f53 The package @lokeswari-satyanarayanan/rn-zustand-expo-template was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71cb82e7b11eea9aa7260ed7a7e31a29e21d10d81735768c536e42ee88d28b71 The package @oku-ui/slider was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/slate-serializer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb7716bab0bde17a29c041cd61a934d39d4717019743671e8d6164fd166c0bdc The package @voiceflow/slate-serializer was found to contain malicious code. Source: ghsa-malware...

Malicious code in @antstackio/shelbysam (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b11f3b36cf4d67018deed9546e206b16b8fa148a32c0802a5e8c51998f1c17e The package @antstackio/shelbysam was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0711033d654f75b42d8959721555bcf5aa5fb766ccc12b6e89c56eef0d8cafd The package @oku-ui/portal was found to contain malicious code. Source: google-open-source-security...

Malicious code in @afetcan/storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4abbde27cce56326711e4e32f42572cb60977ca7ccce4ebf1fcfa558a847c1a6 The package @afetcan/storage was found to contain malicious code. Source: google-open-source-security...

Malicious code in create-silgi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1bd1ddfab5f3ea6caf4f09a93f2ef08f7298e2d68892949e0a6f2975cd1b78 The package create-silgi was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/nestjs-timeout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d9067ab95136128bf92e8d28b434d340ae4fd7cd2c8e06f3378c71c3f6f2b1 The package @voiceflow/nestjs-timeout was found to contain malicious code. Source: ghsa-malware...

Malicious code in nuxt-keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbb088ab2b0e4b6991065c6bcdc57302ff545bb3fe2f2a73ec21fafeae1175f8 The package nuxt-keycloak was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/popover (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b98eecbc4f662192c0aea469b5611692a9f412c082a230adfe80e142c6c0c3b6 The package @oku-ui/popover was found to contain malicious code. Source: google-open-source-security...