Malicious code in @keyv/mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b54da8d83c19dc23fe163d7e333f4529faa01d322fe272066da4964fcf604469 @keyv/mongo is the MongoDB storage adapter for the keyv key-value library. No a static rule matched and no behavioral findings were produced against...

MAL-2026-11495 Malicious code in test-dev-watch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...

Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...

MAL-2026-11342 Malicious code in npum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4a9d6c4d1ca3b910ad0684ec85cd0d1d0dafaa0906f5828455697d0b937874e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11327 Malicious code in lodash-ex (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ddc129136b388cfe448e3253a312b7a54ddc90993e77f4e91fd859b08fbb47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in base58-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e95c5d853c8abc6b99f2a1cc48dda77eb93a732e34c6f253f9451b1a9e7b4d1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dotex-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a24f0c08a385f2366e23764f896e95c701acd9d746152a5409b1b6a1ca4c766b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11355 Malicious code in pullingpackageeee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eeee23ed9e5f55520bb0d6712d26704bf87dc9badeec3180c33a6d2eb31cba9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11186 Malicious code in lwp-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f48a24eac1771fb54fd93711a3e41754360ae043cecf84fcff3c3d1bb30d297e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vinnxcode/xbailsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa85bc699ec69bbebf0799696e784cee3fcd9f78f5ccc9e2cb032e9a9cb3de68 @vinnxcode/xbailsync 1.0.1 is a fork/republish of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to co-occurren...

MAL-2026-11037 Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc009d2d22b9f02aa6b2cce1ac5eadfcb3f3a7d437cc2ba031eb1e6154da2a4 [email protected] shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, backdoor, or self-propagatio...

Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

MAL-2026-10939 Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

Malicious code in @gocortexio/npmgremlinbox-cc-by-nc-sa-2-0-uk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c31160d30fd76b0823b67a8f9a4161aea511b56c897ae8153edd2c0e621f979 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10788 Malicious code in @gocortexio/npmgremlinbox-agpl-3-0-or-later (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22de3b316748990f8d632fd0fa7ca312c4f5fd38ddf61986331ae0ad4c14280b No a static rule matches and no traced behavioral findings for this package version. Nothing in the scanned files indicates exfiltration, install-tim...

MAL-2026-10665 Malicious code in @fhkry/x-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f6c3e5c391d9d3ffeb7f6c1b4154b0266efeb73bdf5543ad81f50236bdabc This package presents itself as a fork of @whiskeysockets/baileys impersonating the original author 'Adhiraj Singh' in package.json and exposing the...

Malicious code in testdonotredeemit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9f9461b13f64b90e569dcc6354708559128c23f4e47e4ac5842b46ce0fb6ed2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in nottuff1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5133eecd8c40ac8e4617b364ea9710a03f88e60f8e2d1252a8ee539282da29e1 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10240 Malicious code in @gt-test-exp/profiler-exp-00000003 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a3e4c3d7eb7ff7cc6100fdedb0043142f7cae8c4cc0b2a3f31f371c77ead14a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pino-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4e878731bc790b53d2b997601e61805dcf1089a8b581ec706e1f970d3de939 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...