Malware in @ecg-internal/media-util-js-lib

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18210 Malicious code in @ecg-internal/media-util-js-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c716438d9014063b4616588b1522ba2de2f3cf4fd961212840ed6a324cced3da The package publishes to the public npm registry under the scoped name @ecg-internal/media-util-js-lib, which resembles an internal namespace. It shi...

Malicious code in @ecg-internal/media-util-js-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c716438d9014063b4616588b1522ba2de2f3cf4fd961212840ed6a324cced3da The package publishes to the public npm registry under the scoped name @ecg-internal/media-util-js-lib, which resembles an internal namespace. It shi...

Malicious Package

Overview @ecg-internal/media-util-js-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

EUVD-2026-46151

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

MAL-2022-1553 Malicious code in bfx-util-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06a182f7174219826e3c695916a2f50d39adc169f803af3428b756cda3e7a9a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in bfx-util-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in bfx-util-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06a182f7174219826e3c695916a2f50d39adc169f803af3428b756cda3e7a9a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...