Lucene search
+L
OssfMost viewed

231208 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:44 p.m.25 views

Malicious code in agentto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cd82c93e5f7bc0005dec9fbf18f01ec45bb6e6d2fb97bad2479c0209a7414bf [email protected] opens a WebSocket to the hardcoded server wss://link.agentto.net and routes terminal. RPC frames received from that server into a...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:44 p.m.25 views

Malicious code in sakuraai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e When the daemon is started e.g. via sakura daemon start, the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:42 p.m.25 views

Malicious code in a3s-code (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6062cbfbdc0c31c48564e4ec850d2ce71996d6cf12373c775aed5560c88e5434 On first import a3scode, top-level init.py invokes bootstrap.ensurenativeloaded, which performs an HTTP GET to...

6.1AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:37 p.m.25 views

Malicious code in date-utils-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bd644fd9a59518d6f77e8d76c077ffef8a2afdc7ae2b00a6ca87299879a671 Package presents itself as a trivial date-formatting utility index.js exports a one-line ISO date helper but ships a postinstall.js that runs...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:37 p.m.25 views

Malicious code in @equans-services/codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d3c5a7e22ef9ecb88e2f6d85ef6132d80098e3e187cbc302de2c45140a5a5f1 This package typosquats @openai/codex under an unofficial scope and ships a postinstall hook package.json line 6: "postinstall": "node setup.js" that...

6.3AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:36 p.m.25 views

Malicious code in mui-option (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1c3ec117eaeedbd4c3f64c2fec97d44e115d400c7e52082b7d6cc28f7c59ec The sole shipped file index.js is heavily obfuscated with a base64+RC4 string-array decoder that hides all module names, URLs, and method identifiers...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:35 p.m.25 views

Malicious code in sync-grove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65248cd6e2924b6485824bcf382441e39d5e09860bc1e849aee0d6d289d184fb Package.json declares "postinstall": "node setup.js", so setup.js runs automatically on npm install. The script assembles the strings shelljs and exe...

6.3AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:35 p.m.25 views

Malicious code in @hibachi-xyz/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29d10da07b92571b7e043b1d5a8735143f7abac8e7759ae96b9f815052f01bf5 On require, index.js enumerates process.env and filters keys matching credential-shaped patterns KEY, SECRET, TOKEN, PASS, PRIV, SIGN, AWS, CIRCLE,...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 11:20 a.m.25 views

Malicious code in @hibachi-xyz/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 214e1b690352ce0af70ce6a37d3b7ac4d8dec4269dc7606b7a65fbb6d4406e8b The package presents itself as 'Type definitions' for the @hibachi-xyz scope at version 99.0.0, but index.js exports an empty object and its only...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 11:10 a.m.25 views

Malicious code in @hibachi-xyz/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54956c91d0cedbe9097a2a8f7fa864382bd3b5a91ba7ccbe4a0219081be711f9 index.js the package main executes at require-time and performs credential and host exfiltration. It iterates process.env and filters keys matching a...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 12:0 a.m.25 views

Malicious code in syft-acp-atoms (npm)

The syft-acp-atoms package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

5.5AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 5:29 p.m.25 views

Malicious code in log-guru (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6da98c6d79df38328235bb1df969316bd484b2a02594f8656772cd9a1e48f16b The typosquatted package installs a Mythic/Poseidon C2 framework beacon and ensures persistence. After installation, the beacon communicates with C2 on...

6.2AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 6:35 a.m.25 views

Malicious code in @fhkry/baileys-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1df6de5ff23e958b57990b451c573aa5d669585436b369cffc01aa122aa8f647 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 5:14 a.m.25 views

Malicious code in @sauruslord/libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c2cf2672d98396a7b66cb732741d269732f5faae72293ea46e06b879e7a45b Package name impersonates Open Whisper Systems' libsignal-node but ships unrelated code. On require of index.js, after a 1-second delay, install.js...

6.1AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 4:1 a.m.25 views

Malicious code in core-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad83962ee4db02c1bf43558ed5fe6bf79f66754b070415223d29643a8ff754e core-dotenv presents itself as a dotenv/env-var wrapper. On calling the package's config or get, which lazily invokes config, a worker plugin.worker....

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 3:57 a.m.25 views

Malicious code in estore-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 3:41 a.m.25 views

Malicious code in webpack-session-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0007695a788bff7d6d0a87ee48de6771c12a1e21241bd3fc0bc7b5509608533e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

6.1AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 3:25 a.m.25 views

Malicious code in leviosa86-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b0bed6337ffe527af2615fed8ae1ecbb449f6a6cb00afa6381f7811ec88956 [email protected] ships src/poc/index.js which uses childprocess.exec to run a shell pipeline that collects host reconnaissance data hostname,...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 1:12 a.m.25 views

Malicious code in @sqlite-frame/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b24506932cbd3f2258f2448b83918ba2acee09cd896467780f8b1dc18b9eb42 index.js is a near-verbatim copy of the upstream feross/buffer library with a single injected top-level statement var ins =...

6.1AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/15 12:1 a.m.25 views

Malicious code in mc-reg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93ca15954536abe30ea5c7f5bc5a06192f3946c98d74edef9d90edbc52cb9d95 mc-reg advertises itself as a Cosmos chain-registry data package README shows chain-registry-style assets/chains/ibc API, but its main and ESM...

6.2AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 11:41 p.m.25 views

Malicious code in iwsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

6.1AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 11:41 p.m.25 views

Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

6.1AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 9:40 p.m.25 views

Malicious code in json-bigint-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bfb97f2d263cd34365f40866529d6c55ee567f38b5d5571ce6b16e49469bfc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 1:58 p.m.25 views

Malicious code in solana-key-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b4680547530fce361014fe8c228734a8ec33bc8c834f46285e371e8f6b9f92 On require, index.js waits 37 seconds, reads test/fixtures/keypairs.dat a 53KB base64 blob disguised as a test fixture, no test harness references it...

6.4AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 12:54 p.m.25 views

Malicious code in process-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on...

6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 5:9 a.m.25 views

Malicious code in clipboard-drop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea807812d5f872524eab6c57931788239310050ffb4c477643977def9dac8fb9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

6.1AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 4:35 a.m.25 views

Malicious code in better-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 3:38 a.m.25 views

Malicious code in skrill-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e517423e768b0086d0579e460801e0b14cb6e6751a810b23bd9f41954d92779 Package impersonates a Paysafe/Skrill payments SDK name 'skrill-payments', class PaysafeClient, spoofed 'github.com/paysafe/skrill-payments' reposito...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 3:38 a.m.25 views

Malicious code in skrill-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 3:36 a.m.25 views

Malicious code in motion-pull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e50d15810c044b3b0355460fdeacea42d89944d351e74bcce9fd976f91915ea [email protected] impersonates the pino logger exports module.exports.pino = middleware, uses logger-themed keywords, ships a ./pino require target...

6.5AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 3:36 a.m.25 views

Malicious code in @velkov/isows (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fee1d7d5125231d00f9c5f9afe9817b76900ca385b7d077bb4b8bcf3d9ca660 Package is published as @velkov/isows while its README, repository wevm/isows, description "Isomorphic WebSocket", and author jxom.eth impersonate th...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 9:44 p.m.25 views

Malicious code in ddok-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0326cd953f229feb020dd3c1cd882246b6bac2cb0be8ffe9e47d063d9f59c9c6 ddok-modal presents itself as a reusable React wallet-connection modal supporting MetaMask, Phantom, Rabby, TronLink, Bitget, Coinbase, and Solflare,...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 7:53 p.m.25 views

Malicious code in react-icons-svgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ccdc7a601182ae60a4f75d72cb54aef12fbe94cb209625f6f1c9be47b12096 index.js stores base64-encoded literals svgValidateKey, svgValidatePattern that decode to the shell command npm install rollup-plugin-polyfill-handle...

6.7AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 2:20 p.m.25 views

Malicious code in auth-gen-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49e38202e2579f6591dbc161817859bb99a212cbf6c1e5482b3271acf8fc4de0 The package impersonates the pino logger README assets, keywords, and internal filenames such as lib/proto.js, lib/multistream.js, lib/redaction.js,...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 9:21 a.m.25 views

Malicious code in chain-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c281292766d55cda3ff1b006154150aa05d567a4f8115534788ffbbc014f3e7 chain-guardian presents itself as a mocha gas reporter typosquatting eth-gas-reporter but its main entry index.js contains an always-true gate var op...

6.5AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 9:0 a.m.25 views

Malicious code in turbocalcng (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f668de627f83b0348d681edd090804f202add609fdc9a3c671f987608fb448 turbocalcng/init.py imports arithmetic.py, which — beneath a facade of arithmetic helpers — contains an XOR-obfuscated in-memory native code executio...

6.4AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 6:51 a.m.25 views

Malicious code in terminal-mascot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fdf1ac60d0060cb78970c884bcfa7bb5360d9f700c0f8992b66af09cce22ae [email protected] ships a postinstall script install-check.cjs that resolves a bundle URL from a remote JSON config at...

6.3AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 6:51 a.m.25 views

Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

6.5AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 6:27 a.m.25 views

Malicious code in abuden226 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8a4986d9e75be69083a7905e5ef5e4558e17fe8b9f15777a9cd692c882b9d6b The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

6.2AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 6:27 a.m.25 views

Malicious code in abuden2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01fc679091d0bd079249822993efce7f3ed4ef7d032c73f9aa730a6259f76cb6 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

6.2AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 6:27 a.m.25 views

Malicious code in nottuff10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec6b68489cb95001c5971ace33533e31169126fb141feea65e198756e66c05c The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

6.2AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 6:27 a.m.25 views

Malicious code in ratelimitsucks10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ea43317a905d4e9b4a22dac3a0e325d92493557c5dc6b376f2e05d84d2fb29a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

6.2AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/13 12:0 a.m.25 views

Malicious code in slds-lsp-client (npm)

The slds-lsp-client package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Salesforce SLD...

6.1AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/12 8:48 p.m.25 views

Malicious code in react-next-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286869faf09aec1d62b472e43a7188a1583c5cf8c999d1fb2e116f0b7f5ba8c6 The package impersonates the pino logger README/badges reference pino; module.exports.pino is the middleware while its name is react-next-vite. When ...

6.2AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/12 8:46 p.m.25 views

Malicious code in api-changelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname,...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/12 11:25 a.m.25 views

Malicious code in eth-agent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3131490d64c4ae90de2926ca90f6fce23e6a113d1e6538db5ce98ffcf06983d1 The top-level ethagent/init.py performs an outbound HTTP fetch to a hardcoded IPFS gateway URL...

6.3AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/11 9:32 p.m.25 views

Malicious code in google-caja-bower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34339f1be6afb8a41b6dbe2f7d7c480d5a438a67ff119b235d1d98ffa2b2e4a [email protected] declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install. index.js walks the...

6.1AI score
SaveExploits0References8
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/10 6:37 p.m.25 views

Malicious code in paysafe-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4db76c1b389e2c8d019eda8a0b6f3b8c28193fd3f9de4abe6234bab1e595e619 Package presents itself as a Paysafe Checkout SDK but is a credential-stealing lure. index.js defines a PaysafeClient with fake payments/customers AP...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/10 4:47 p.m.25 views

Malicious code in notify-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fec337f1c1858ad605f875ea51feb09f84fbd2eb702c7bc0462dbb427b3eff05 [email protected] presents itself as the pino logger export name pino, README and type definitions mimic pino, npm version badge points at the...

6.3AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/10 3:59 p.m.25 views

Malicious code in stella-ai-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 936d3c8bc6611b58f5321ba5aab651bb3d2db821d172816283ca04633be00863 The stella CLI shipped in bin/stella.js prompts users for their phone number and the WhatsApp verification code and POSTs both to a hardcoded bare-IP...

6.2AI score
SaveExploits0References9
Total number of security vulnerabilities5000