MAL-2025-190691 Malicious code in @zapier/secret-scrubber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c109e973086267fe5b99a110c559267a26254a0bb87dcffbaf3fb69ea4bbca75 The package @zapier/secret-scrubber was found to contain malicious code. Source: ghsa-malware...

Malicious code in @dealmgmt/grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 3f1e7bb02af2f24d6a057db349128269908eb7e771722c7cf8aa637d3974058a This package installs a dependency hosted on a custom domain that runs an info stealer during installation. The info stealer focuses on...

Baohuo Android Malware Hijacks Telegram Accounts via Fake Telegram X

New Android malware Baohuo hijacks Telegram X accounts, stealing data and controlling chats. Over 58,000 devices infected, mainly in India and Brazil...

Spyware Disguised as Signal and ToTok Apps Targets UAE Android Users

ESET warns of fake Signal and ToTok apps spreading Android spyware in the UAE, stealing contacts, messages, and chat backups from users...

MAL-2025-47450 Malicious code in hello-shai (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 297f2a57d1c225e18d8464c2024daef4567955be0eb8cd8d45052aa778fb4f3a This package was compromised by the Shai-Hulud NPM worm. The malicious payload steals tokens and credentials and publishes them to GitHub...

Malicious code in devextreme-rpk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f74fc68752b93858b4cd802b0c1c9c940779258a08c206b0787ebf5b94bc9738 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ui-ux-gang/devextreme-angular-rpk (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e5992d6feea9798115c98d409170302c758e89417f30a1fbef8e51a4b48f9a1 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @art-ws/prettier (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0ad654106f2b917f883774d7484c2a6e0b8321808a7693b56ce60c52eaf85e3 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in capacitor-plugin-healthapp (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ed67ecd3a89635aa7072f0b0399ad7c1fa0f7805c8bbe59b9a775654e5acdab Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in @teselagen/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63813f363810c8dc88bfa35fbd3a365de9e23c00d5543cee6ef87dfb6e61b5a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @teselagen/bounce-loader (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2f86497a8f8ebd289f9296f0d154c87fd2429bdf4fc8de97c6b1684ed3b9aaa Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47346 Malicious code in rxnt-healthchecks-nestjs (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91466f0176011b114548780f79ecab9da3b995e89243c07548ea8be6e4a7b0d9 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in rxnt-healthchecks-nestjs (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91466f0176011b114548780f79ecab9da3b995e89243c07548ea8be6e4a7b0d9 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47344 Malicious code in react-jsonschema-rxnt-extras (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e29ae9593362f6ccecd21ee9abaabfe0baf7da78be18ebeeef87277d03b1f56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47213 Malicious code in ts-gaussian (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28976f40d9c1e8c05d8a074ce4984cedef949d2d116e5131b5db71e55cd43695 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in swc-plugin-component-annotate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65e72154327975b96053186a0016efcacea667730e163b10f507b40b94254047 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ctrl/qbittorrent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af92aa639259dc9a287445d9fdbb2ec61beeb5adf71ff13a6e8f9bceb79971a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in angulartics2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01f9e16a7709f6cff6095712c304744ad8bccf097dc5d86d3bbb5f01cb608382 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47147 Malicious code in @nativescript-community/gesturehandler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c25d691508dd5a2da24859854f28998b2bc0456d3e73edfc5aeeb61c2fd7d1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview tclients-sdk is a malicious package. This package contains malicious code disguised as a legitimate cloud client utility, and its content has been removed from the official package manager. Its primary purpose is to steal cloud-related secrets, such as API keys and access tokens. The...