MAL-2026-14006 Malicious code in priority-mutex-lane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd0cb794e1b53c6b4c63bdd456196771029c0c003a33694581dadd3707acf0e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sui-gql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86abb4ef26b5c61e261c09d96823d64e6bfac2de04c8da1c2be9b738a47a70da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13796 Malicious code in cvbmxiowkwqla6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dbfcc7e82fc725383c9578e9d53c4e69bdf6af9ba8037d2bf9fa50dce51969e Package [email protected] contains only two files and no behaviors matching supply-chain attack patterns were identified. No lifecycle scripts,...

MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

MAL-2026-11098 Malicious code in crm-reportinsightserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed758e4154bc29bda7b5ee78165766980d88068090a9853a2243509d97c11152 [email protected] executes a preinstall script index.js that collects installer host identifiers — os.hostname, os.platform, os.arc...

Malicious code in sixbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91338e6d735e538b7defb669e5b213cad127a9fd64290fa32d83bb855dcf9bd sixbails is a WhatsApp Web library Baileys-family fork. On every socket creation — the package's primary documented API — a 5-second timer fires...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

MAL-2026-10846 Malicious code in @gocortexio/npmgremlinbox-qpl-1-0-inria-2004 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 269cfa8afaaef9836a6f0d2f53e1a6e72cfa7a3c466c4831bb5c7269e7d2bf73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10840 Malicious code in @gocortexio/npmgremlinbox-ms-lpl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c00cf6119e52189754e58f2c2460b83968a20c5086aa9424d58123b077c9e7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10827 Malicious code in @gocortexio/npmgremlinbox-jpl-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba27e14255b949c635452dafe1c837fa1146d33e5f4261ca7b5441f84e2fd388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xnder-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aeeac149a5afa4797eea935b2a54b66fcf2cfd939fce855655208245ba9e5a7 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation of th...

MAL-2026-6865 Malicious code in polymarket-onchain-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73556a574d8ee416a5440f889b73cafff3b464650d6b2b2caf4001ce15086f6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pino-pretty-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7864fcfe92b62b2ddc003e696cbe02d18e0979f4336bff4cc9352f318b260fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gallup/pc-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eca755b4cbe794ce9b1389cff974fb13df6325eeb2eb658ca64a7bb7ee734b8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6407 Malicious code in @su-doughnym/hubspot-loginui-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72fa1e159f93bb8a1336dc48fe329f3a7801ebf56a49620ce67fd013ea8995ae Package is openly labeled a dependency-confusion proof-of-concept and uses a high version number 99.99.99 consistent with that intent. The preinstall...

MAL-2026-6204 Malicious code in ts-ecro-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86149b041033a917b3b743b9381a14368e79015385b27b89429cf7f6a35d0d30 No suspicious behaviors were identified in this package version. There are no lifecycle hook hazards, no outbound network calls to attacker-controlle...

MAL-2026-6111 Malicious code in @rafaelsene01/agent-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3855afe87d31e428546f226e1da9236cd0e4dc45a477afb9f6ba1c707a4b05ec The package's main and bin entry, dist/agent-flow.js, is shipped as a heavily obfuscated bundle produced by javascript-obfuscator declared as a...

MAL-2026-6041 Malicious code in @mastra/upstash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 109a798f50c4d4a1e3d840f494f4febeee6911daa9b2ecb5d1a6dfd7369a96c9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/pg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a70008c61b1e4ef205086d9fbbeb0435c8cee10e414626617fec6b946d45c84 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...