Malicious code in @addai/ainode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261 After a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at...

Malicious code in @zhengshuo888/huoke (npm)

Source: amazon-inspector 6f352f11f7811b28966799c9359f99dbbe9829240066504be17c100981dd45ab On npm install, the package's postinstall hook runs node bin/huoke.js install-skill, which uses execSync to invoke curl -fsSL against https://raw.githubusercontent.com/amswf/huoke/main/SKILL.md and writes th...

MAL-2026-899 Malicious code in dzuseragents (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f0be670ad8e17f42129943a744559ebb8818c581bc637c1469cf8553b7b8f8c9 The package downloads an executable and adds it to autostart. The downloaded application then periodically creates a screenshot and sends it to a Discord...

PT-2018-6156

Name of the Vulnerable Software and Affected Versions: npm-script-demo affected versions not specified Description: The npm-script-demo package is a piece of malware that opens a connection to a command and control server and executes the instructions it is given. Any computer with this package...