Malicious code in drop-events-on-property-plugin (npm)

Source: amazon-inspector 9ec0ea7d31f1e0fec815bf2b3893bc6e320c5c3e309b43d22130d5af8a52a033 The package drop-events-on-property-plugin was found to contain malicious code. Source: google-open-source-security 7491735851cc3c4e363b579ed9a0e6365134a2efa15061fb22c6fed56bb98332 This package was compromis...

Malicious code in create-mcp-use-app (npm)

Source: amazon-inspector 2781601c3ba0c5d6d4b78bf322d88a4d189473e68d2382c171106342acacd271 The package create-mcp-use-app was found to contain malicious code. Source: google-open-source-security 718d4d0c5748f26d9c0e556f1914ad2b646ee3e9bec9cfdcb7222e201886ffee This package was compromised by the...

MAL-2026-11622 Malicious code in @onereach/postcss-scoped-selector (npm)

npm/@onereach/postcss-scoped-selector is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

Malicious code in @antstackio/eslint-config-antstack (npm)

Source: amazon-inspector df3b34f284b315d21cd0f6b7ea57e1fc8b908ade13ffde115d3fb1f6727c7d4a The package @antstackio/eslint-config-antstack was found to contain malicious code. Source: google-open-source-security 9cef6b06b4f6b5856fb26d1d823db7d7f92e0f37bcd85edd0a6ebe0bead3c9eb This package was...

Malicious code in @antstackio/shelbysam (npm)

Source: amazon-inspector 9b11f3b36cf4d67018deed9546e206b16b8fa148a32c0802a5e8c51998f1c17e The package @antstackio/shelbysam was found to contain malicious code. Source: google-open-source-security 1e5b33ede3ba1777afcff68cc86bdbf5fd49e658ebdb08d925efff854f4fedd4 This package was compromised by the...

Malicious code in @afetcan/api (npm)

Source: amazon-inspector a0a79aa802450fc62bcdf8bdb70d6619752f6db790e68472e80016d5893111ba The package @afetcan/api was found to contain malicious code. Source: google-open-source-security fa915cfff470cee0e001515013e5dc3e91ef7461760e0e6df54188d6bea2c130 This package was compromised by the...

Malicious code in @afetcan/storage (npm)

Source: amazon-inspector 4abbde27cce56326711e4e32f42572cb60977ca7ccce4ebf1fcfa558a847c1a6 The package @afetcan/storage was found to contain malicious code. Source: google-open-source-security 6185482e2a1647e6f4e6383ce2aa50d651187f6a3f821328d87e13ae342af5bd This package was compromised by the...

Malicious code in knot-date-utils-rb (RubyGems)

Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal credentials, set up ssh access and tamper with build/workfl...

Malicious code in knot-rack-session-store (RubyGems)

Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal credentials, set up ssh access and tamper with build/workfl...

Malicious code in knot-rails-assets-pipeline (RubyGems)

Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal credentials, set up ssh access and tamper with build/workfl...

Malicious code in github.com/BufferZoneCorp/log-core (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

Malicious code in github.com/BufferZoneCorp/go-metrics-sdk (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

Malicious code in github.com/BufferZoneCorp/go-stdlib-ext (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

Malicious code in github.com/BufferZoneCorp/go-retryablehttp (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

Malicious code in github.com/BufferZoneCorp/grpc-client (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

Malicious code in github.com/BufferZoneCorp/go-envconfig (Go)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...

Malicious code in cache-compat-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fc75889476bd737b302c856fb1d2da1b263a93786bc27fed3978c3eb0584cd The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious Package

Overview search-engine-setup is a malicious package. This package contains malicious code, and its content has been removed from the official package manager. While this package typosquats well-known libraries to impersonate valid open-source ecosystems, there is no connection between those...

Malicious Package

Overview nicegui is a malicious package. This package contains malicious code designed to steal sensitive credentials and establish remote access. While these packages might attempt to impersonate legitimate organizations and popular open-source libraries, there is no connection between those...

WS-2019-0480

Stream-combine v2.0.2 contains malicious code design to steal credentials and credit card information. The code searches all form elements for passwords, credit card numbers and CVC codes. It then uploads the information to a remote server if your application has Content Security Policy set you a...