Malicious code in omhcsilence-bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f5390575abcab0cfc57edaae4aa14d27eab897c1639fab8a502fcda0760adc3 The package omhcsilence-bails was found to contain malicious code. Source: ghsa-malware...

Malicious code in @vtim/xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 947e0af0661087703ab13fc4220ceff05dafffb94addd8243f90a86929beaf3c The package @vtim/xss-poc was found to contain malicious code. Source: ghsa-malware 20e54e730a6708f44f0828a03bf7ac5c9fb2c88074659d45570d90af289eca84...

MAL-2026-1449 Malicious code in vtimmmmmm-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f98c647bcb6a277d8ef94407b1287e79a9840e0956aa955ff01ea19778219c7 The package vtimmmmmm-test was found to contain malicious code. Source: ghsa-malware 7f04d92a8262ba75c225fb58633a5dfbe7c1d4a750b88f634dde448a81e13b63...

MAL-2026-1440 Malicious code in @vtim/xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 947e0af0661087703ab13fc4220ceff05dafffb94addd8243f90a86929beaf3c The package @vtim/xss-poc was found to contain malicious code. Source: ghsa-malware 20e54e730a6708f44f0828a03bf7ac5c9fb2c88074659d45570d90af289eca84...

Malicious code in nest-moralis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7568b91354492a39b40ca156221b4a94c94808517fbf09ae48954ba5da0febfd The package nest-moralis was found to contain malicious code. Source: ghsa-malware f5ebd5810f65b46e709e5d8a09a1b3a421a0aac599af1ef51e8bb433afddba48 A...

MAL-2026-1445 Malicious code in nest-moralis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7568b91354492a39b40ca156221b4a94c94808517fbf09ae48954ba5da0febfd The package nest-moralis was found to contain malicious code. Source: ghsa-malware f5ebd5810f65b46e709e5d8a09a1b3a421a0aac599af1ef51e8bb433afddba48 A...

Malicious code in up2-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc22b1546303513e047c5c729ec0f40a5880bf1dd5981592933c689f4cbf3e6 The package up2-daemon was found to contain malicious code. Source: ghsa-malware 4b6e1244d13ef29a84a4b55701182d9aacbd9feb8c6979534eb0493c28ab6e9a Any...

MAL-2026-1448 Malicious code in up2-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc22b1546303513e047c5c729ec0f40a5880bf1dd5981592933c689f4cbf3e6 The package up2-daemon was found to contain malicious code. Source: ghsa-malware 4b6e1244d13ef29a84a4b55701182d9aacbd9feb8c6979534eb0493c28ab6e9a Any...

Malicious code in minify-replace (npm)

The package 'minify-replace' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.co...

Malicious code in transform-jscript (npm)

The package 'transform-jscript' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in transform-jsbi-to-bigint (npm)

The package 'transform-jsbi-to-bigint' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in transform-remove-debugger (npm)

The package 'transform-remove-debugger' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in transform-property-literals (npm)

The package 'transform-property-literals' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in transform-undefined-to-void (npm)

The package 'transform-undefined-to-void' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in undeclared-variables-check (npm)

The package 'undeclared-variables-check' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in ignore-html-and-css-imports (npm)

The package 'ignore-html-and-css-imports' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in es6-recommended (npm)

The package 'es6-recommended' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in import-newlines (npm)

The package 'import-newlines' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in no-type-assertion (npm)

The package 'no-type-assertion' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in monorepo-cop (npm)

The package 'monorepo-cop' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...