MAL-2026-11212 Malicious code in @goodjavascript/dotenv (npm)

@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...

MAL-2026-11179 Malicious code in @zannstore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b310179032a3c10c00d359e9152740aa830a1d9d5ea97367f7b8b4d6d1f42569 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11161 Malicious code in @joyfill/layouts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48d31efc1aa4ad0afbb16e357a08eb80ab4c39bca8dab1723ead698363e0edc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11160 Malicious code in @joyfill/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61cf3fd63a92e5d2f5ffdbc70713656d7b347072c046aed9e9ba65fbc7c1e76e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in motion-forge-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a45490446ee8d16ef3eec35619feeb7cfc2a870de4d2db869e65999ff39baa5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 832cecce176cee15be4875642bd875636a40159560e29bd359746b2c80359e10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-twofa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b53f3137f847d7234a065286565e0112a828bb14dd580d6ea46a9c262397294 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in identityauthorizationserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef1d43e872519f6b1865d149c6f202e9079165bc28c12645e8154155d61e7455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in demo-awesome-date-parser-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dac7edbd7a941a69901501e2f602b37a483dde93aac9af9270f146fea0e7992 The package advertises itself as a date parser but the public API demoParseDate performs several unrelated hostile actions against the calling...

Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 493d92c75a6ab0daa328300c9f6a6b177a8a4fd656b8f0431f60e11f1ef3e060 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-motionkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44ccc8950e5ba2f4445eb663dafe54d1abf35fc0af58cb14d449fa66ccb26a38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11053 Malicious code in app-data-lts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f35120670504586b6090e4cac9dd795b88170e1da09a6f0ad6955b665a6cda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11054 Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

MAL-2026-11052 Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b8c073af489e9e7102ec43ca525f91f88615b572d4d0b0e65c6b64b647f93ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11034 Malicious code in eth-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a547e155b232bc3164db9fc1f7de92bf70a5f1ad02e277a6c9b272d47f48e00d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11039 Malicious code in yuinpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d036e3cc02bd090bae9ff004d7559fd524b963bb47fee0a0a6cd6baf1395c2be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11036 Malicious code in streak-lib-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...

MAL-2026-11038 Malicious code in svelte-streak-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5b8b3f2004d4b7fc0d461cf156a56b761cd77ed98c7023af0a012467786747 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-lib-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...

MAL-2026-11037 Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e778109e3800d6e2c265494be646061aa4d3d109a7ce8d423e915acab664c181 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...