Malicious code in lookuptest11 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in super-color (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 908af2bf828b75158c5bf0aae5a9d422694f21f566a745ff42b82f1f7ed4560d Package hides a code downloading and installing an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in supercolor-tui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9798fa32337256d29d4b551193b6aa6817601034ce787bae4d09d7d6636d813b Package hides a code downloading and installing an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in control-character-command-injection (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75 The gem declares an extension script in metadata.yaml that RubyGems executes during gem install. At install time the script reads host identifiers...

Malicious code in agentic-call-control (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5 The gem's native extension script executes during gem install and harvests installer-side data without consent. It collects host identifiers current...

Malicious code in dynamic-object-handler (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b The gem declares mkrfconf.rb as a native extension in metadata.yaml, causing it to execute automatically during gem install. The script collects the...

Malicious code in donjon-ledger (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247 The gemspec declares ext/mkrfconf.rb as a native extension, causing it to execute automatically during gem install. The script ships no C/C++/Rust...

Malicious code in blender-headless (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edaff2bd9abfea10a907cf99f87b444eee0c7ff54e88face42fe7c000d64775 The sdist setup.py and the gcplogpoc/init.py module both construct a DNS label of the form install|import-random-id.blender-headless-platform.node as...

Malicious code in infra-libs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32 infra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the...

Malicious code in expect-tests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76 setup.py and gcplogpoc/init.py read the installer's hostname via platform.node and encode it into a subdomain of testa213022.dssldrf.net, then invoke...

Malicious code in rainbowcolors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd The package advertises itself as an ANSI-color helper but on Windows the first call to any Color method print/paint/call downloads an opaque executab...

Malicious code in chromacli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faa55f651aa1c9e23d9cbff405b6ca52086c950c76e05e04b8dd49f74dd19959 The package presents itself as a terminal color library, but its exported API Color.paint / print / call contains an import-reachable Windows code pa...

Malicious code in @htooayelwinict/travis234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2063ecf38d2b7342633616dbfe9b2933f1e9d9ea73116105e55d6313279ac6e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twitch-stream-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c Clone of a legitimate package with injected code that downloads and executes a script from a remote location. During analysis, the remote code was no longer...

Malicious code in pyuserox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9554cf718372c4b1b545c805969d454a5baa65b62274339b1a00fd80ce6e7a86 During import, package silently download and executes remote code. There is no other action. During analysis, the remote code was no longer accessible. The...

Malicious code in pyuserfox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 23edaa0c720d313b1598b1391f83081eab817e337c65033b28755ad7f46af0dd During import, package silently download and executes remote code. There is no other action. During analysis, the remote code was no longer accessible. The...

Malicious code in gcp-log-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc8768984228dad1312621516f92e43e4c61aa5d310161a286355672d2f09a94 The package runs identical exfiltration code from both setup.py executed on sdist install and gcplogpoc/init.py executed on every import gcplogpoc. O...

Malicious code in qzc690384 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aaf64364e0f3a5688772d501b9400cd9caf65ecdc82a869844ff73999aff2e4 The adjudication model's output was cut off by the provider safety filter on every attempt, which happens when the reviewed code reads like operation...

Malicious code in qzc690383 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06 On pip install, setup.py executes shell commands to collect installer host identifiers id, whoami, hostname, uname, nvidia-smi output, /proc/1/cmdlin...

Malicious code in qzc690382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e The package body is inert init.py contains only c\n; the entire functionality lives in setup.py, which runs on pip install. During install, setup.py...

Malicious code in qzc690385 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 769e3917f43083b27dfab168a49801cf5d70393de27f359bc406ff2260f23edb At install time, setup.py polls the local Xinference API at http://127.0.0.1:9997/v1/modelregistrations/flexible, selects model registrations whose...

Malicious code in genblaze-atlascloud (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in genblaze-fal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 253796cb8693d039c09267f3d6d398031e3ad27640bb70f21f2e75d2578be649 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in dsh-notify-focus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91c538bb4d09c5ad66bc46daa4a39dbc36c87c314f92a9faf5738a3e3581ffe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pulumi-doppler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50b46d564c0937fb09c4343eb0c9a8eb2d33b8b4eca8b85b5419ebd686100e06 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in @cherrydotfun/miniapp-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f67d291f8d7fbfc32f2fa1e88ea8e02074821d6f7ac1675a32a15d87e51be139 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fhqiouhq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50625c43075a763e4420504dcbcc8b14236874f2924ec20eabcf5d7b45b0a274 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in ajfhiuqhfqgwerhuqnfqh (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1da9c2dae077cc96d13ab9964ca2887742f0dc1bc2a3e92f4b0bf9b6d0e3b04 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in reqnests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 285a91689676a0169502a364e60033283150056487ad681648ab60cb4fe6d23e During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in reqnest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 819e0998a4223acf5f70c15fbbeea8f9c9bf801044d5974622ebc2a971bc2c61 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in tailwind-animationfound (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5725a79f072138dd41b4b01a7b85f4db141a064f8b9b0d1f9b2f58de46b38b57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in modelsdesk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 245d6cf605a8824c3c98e826cbba55c70291bb6d26c1639c306a7a0cf565ed75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kampodine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42480f59964b6128cd6e0d2fdb239ac695aa0ac534f7d4577ea56331cb105715 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in automic-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7cd96d34518e6d009a6d720791d1bcdccb28c127f0abe189cdf21823feb64e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hello-bat-fwi9 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c6e2592290251692bc9a99a87bea6d2e945087b27bb872b2a8bbf8bd738a575 The wheel ships a 2.5MB obfuscated hello.bat that is invoked by the package's advertised hello function and by the hello-bat-fwi9 consolescript. On...

Malicious code in monobomber (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb048ce530214799000fdcb8886e4731fac2c5d63cf673c431384001fbcfa2f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in monopw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9eea2030fc78f02622fac87418eb061c00f88e7f06bde0cad322331f24ea428 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tw-motion-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6126defd99b4d1f60df367804e1700624cdb6e02d2447160c98a901839b7b475 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wisdomtreetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e4630a25894ac32585fce0321742859b4abeb85e165ec7c1f1db0948678c668 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @noinheritdoc/n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d6fb3554c37166a7d69d4bf5f672bcc2f0461d763c685b99b4af654e0e0c874 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @site-cms/ssr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84e138f3690a5d6e147d0f73db95583647a9cf3ed0c7f8beba73d89bc28f5bb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sideeffects/n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5c4de6df1f4a8ce4bbbf205ce1e053b684ba72c4bfe1c36b9d6f8f40b01fd7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ts-expect-error/n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb1181753b662057b42470341334eb06f4dd5e66ad121abf172ed8cd812dfa7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @needsaudit/nexport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3075c04420ad628321590fb8d6c90add7dd1e2940afa1c40ec2a1e87569800c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @needsaudit/n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6597c3fd2a454df33edf83d187ebdc7efb1764c8319c3ae0ea57abcc6ee8938e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @smart-dev-wa/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in zero2-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba57fc7bb4bcf036443073304ad388fbd23b2cfff4aeebfca8fcf50baf1ee0a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in securedrop-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f10f1f6b11db2b6dd5c7d36e77cf8d83dba43ae2f4dddb06ce752beaaae5bc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arc-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b435bceea3dca010177d87d412866993c2dd5c9e99ab31994eab56b202f1e93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kc-kline-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 248c91825aeab2e07e381ad4d4816abcb644771c1d3aac0239dd99045d7f5f7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...