Malware in @fyxzpediaa/libsignal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @fyxzpediaa/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values

Summary ODF style attribute values are interpolated into style="..." attributes without HTML-escaping in both of odf-kit's to-HTML renderers odtToHtml and odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute...

Malware in noon-contracts

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ai-ecoverse/slicc-windows-amd64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in screenshot-desktop

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in sound_deer_apricot-15 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in valid_antlion_amber-50 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in itchy_gecko_magenta-98 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in temporary_smelt_lavender-81 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in pure_opossum_amaranth-54 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in unfortunate_crawdad_emerald-79 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in intimate_ostrich_amethyst-45 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in smooth_angelfish_emerald-54 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in motionless_mandrill_blush-51 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in specific_sheep_violet-22 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in southern_duck_tan-16 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in xenacious_kangaroo_blush-47 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in inadequate_earwig_magenta-66 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in hushed_zebra_green-81 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in gugodapis (npm)

Dropper. At run time the package downloads a Windows batch file from a remote URL into the system temporary directory and executes it with childprocess.exec. The payload is fetched, not shipped, so the code that runs is controlled by the remote host. Version examined: 1.0.0; tarball SHA-256...

Malicious code in hollow_wildebeest_silver-94 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in et_phone_home (npm)

Runs on install. The postinstall script fetches a path from a bare IPv4 address with wget, contacting a remote host from every machine that installs the package. Version examined: 0.0.5; tarball SHA-256 58f9b4c9c26abe6ac52353ce1e0a824fba06c8aa7cefa94d2d4805306053e82c. --- Credit: OpenSSF source...

Malicious code in babyyodaa (npm)

Runs on install. The preinstall script marks a shell script bundled in the package as executable and runs it; the script contains a reverse-shell pattern, giving a remote party a shell on the installing machine. Version examined: 1.1.0; tarball SHA-256...

Malicious code in colossal_wallaby_pink-87 (npm)

Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...

Malicious code in @signals-notebook/annotation-editor (npm)

Runs on install. The preinstall script sends the output of id the installing user's identity and groups, base64-encoded, to a request-bin host with curl. This is the dependency-confusion probe pattern; it leaks data from every machine that installs the package. Version examined: 2.2.60-630109c;...

Malicious code in @ubedsockets/baileys (npm)

Malicious package. @ubedsockets/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. On connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...

Malicious code in @atfm/utils (npm)

@atfm/[email protected] is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The script...

Malicious code in @ifasn/ms-doc-mcp (npm)

Source: amazon-inspector 89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d Package advertises itself as a Markdown toolkit MCP server TOC generation, word count, table formatting but its main/bin entry unconditionally invokes an imdsAudit routine at module load that probes the...

Malicious code in @atfm/atfm-material-ui (npm)

@atfm/[email protected] is a dependency confusion package: it uses an inflated version under the @atfm scope so that a build resolving an internal @atfm package of the same name picks the public one instead. Its package.json declares a preinstall script that runs on npm install. The scrip...

Malicious code in brida-frida-hooks (RubyGems)

Source: amazon-inspector cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d The gem declares an extension script in its gemspec that executes during gem install. On install, the script collects installer identity and local system data — current working directory, home directory,...

Malicious code in w002yardprobe (RubyGems)

Source: amazon-inspector 721580f8eda44ad5ee7604f5ba0648e8830302f784e3e4a995e02ca7359c909e The gem ships a .yardopts file containing --load./script.rb, which causes YARD to execute script.rb whenever documentation is generated for the gem locally via yard doc, in CI, or on doc-hosting services suc...

Malware in yzx-npm

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in mocha-ui-themes

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in protecteda (PyPI)

Source: kam193 8fb01cc262b8645b045f6d9b6e0454ef525c928a48f8c0904cb63301f1be9e0f When started as a module, package runs an embedded executable identified as an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-protecteda Reasons...

Malicious code in ln9qw38745g (PyPI)

Source: kam193 e0a9c91e26a02abe14a9881a1c539a2f48d71aff120be6a4c286f36ee4cdd603 Package ships an embedded executable identified as malware by AV vendors, and is related to a previously discovered package that after a few releases swapt benign exe with a malicious RAT. --- Category: MALICIOUS - Th...

Malicious code in zyto (PyPI)

Source: kam193 817f92245d406e764c42e8038b2ea559a6bd6deb1706b80e2699e0ab724111a2 The package ships an executable started during the building of a wheel/installation. It has been identified as malicious by some AV vendors, but primarily it is a preparation to embed a RAT as in another campaign's...

Malware in tailwind-form-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in react-contact-forms

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-forms-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwind-input-kit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwindcss-contact-form

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tailwindcss-form-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @touchkey0111/jito-bundle

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in jito-bundle-jitotip

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in jito-bundle-solana

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in jito-bundle-jito-tip7

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in jito-bundle-tip-7

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in bandkit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in arbkit

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...