Malicious code in @testrelic/appium-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b67d6f23451a756c154b86142f91615f5c08c415166c1f66216c8c83d74cbeb The package registers scripts/postinstall.cjs as an npm postinstall hook. Alongside a benign-looking config-writer, the script contains an obfuscatio...

MAL-2026-15640 Malicious code in @baipiaodajun/mcbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9b824aabfb54c78238352f2f5c5a9842353be165da9e42d9f1604a6fdb923b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15639 Malicious code in @baipiaodajun/mcbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 263956cd317cc9d1f0b3a68862e1f3c75ed8fa2652adcf49956e792184559c8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15643 Malicious code in @baipiaodajun/reverseproxy-fm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccf42e2bbdc37821aaae826c6225239d6a8ceeb3b1e89744b79f99c8de98bb28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15641 Malicious code in @baipiaodajun/npmsshx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e607fe03408d07ef1d219557cdf4a173b4c59fb061fe4aaaeedfcb03d1d5a8f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @baipiaodajun/reverseproxy-fm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccf42e2bbdc37821aaae826c6225239d6a8ceeb3b1e89744b79f99c8de98bb28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @baipiaodajun/npmsshx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e607fe03408d07ef1d219557cdf4a173b4c59fb061fe4aaaeedfcb03d1d5a8f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @baipiaodajun/mcbots (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9b824aabfb54c78238352f2f5c5a9842353be165da9e42d9f1604a6fdb923b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15645 Malicious code in kisama-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0179b9fe97920f04431eb6d6e94b46c6ef2889af5e55d6a0b79793097187fed3 [email protected] ships an obfuscated index.js that runs an HTTP+WebSocket agent binding 0.0.0.0:8000 by default and exposing /api/exec POST for shell...

Malicious code in @baipiaodajun/mcbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 263956cd317cc9d1f0b3a68862e1f3c75ed8fa2652adcf49956e792184559c8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pig-ui-first (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 101f4ed775c904f1711511e291a76113103ac463d5b9002b77eed3970065be0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pipi596888/ccursor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15644 Malicious code in @pipi596888/ccursor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in selfsigned-certificate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26324f10054a4b02e6d50af8f5373115e113a01c37d636ed70df2be1dd1b6b92 index.js contains a hidden code path where calling the library's generateCertificates API with the value 10 triggers loadSampleCertificates, which...

BIT-KEYCLOAK-2026-16104 Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

ship-safe v9.7.5

The independent security agent for AI-written software. It finds issues, investigates whether they are real, and shows you the evidence. Website · Docs · Security & Data Flow · Benchmark · Pricing · Blog · Contribute Ship Safe CLI Ship Safe runs locally in your repo and works in two layers. A...

Malicious code in redis-cookie-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c94026a508b2ada8c891551c8ccd622f86c2ba2e7b6a7c181fc3eb538e2f1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in cloudfcrxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1caf6a2a9c9e406a086a5eef2c95f0248003441ebb663fb0fd215aefd9565198 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @fidzzhost/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d9c64f9aae78384f16b90881eb1d1eaf304c426729bfa56e206fe84b0b10007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cloufcrxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb997ba2e8af58bd0d35d6e2cfb2264b4ae0132e071fc5b0e3e58f3326e37a9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...