Malicious code in @gusmano/reext (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 498a21b60dcdfe236ea0b1683e1ec64aa091643b6ad562c3845757eed79660d8 The npm preinstall lifecycle script dist/scripts/preinstall.js, wired via package.json "preinstall": "node./dist/scripts/preinstall.js" reads the...

Malicious code in 01-0redi7qgbz0uv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ceb633970757ab5d5ee0b64512c18d46be8402ac2169769101655a697ee5d6d the analysis found that this package has a garbage randomized name '01-0redi7qgbz0uv', empty description, placeholder test script, and an index.js th...

Malicious code in 1mi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a68ec5fa97918431510ba9ef57d3d601738891094478b5ebf996a3eafa0cb960 This package masquerades as a Cloudflare Worker Telegraf middleware README: 'cfworker-middware-telegraf' but its main module unconditionally forwards...

Malicious code in 0ctf-chalweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d7a129ab6079febb92ceac3587af97653477bce8a65b8e85bfa5bcae0293b0d The package's entire content xss.js is a 2-line cookie-stealing payload that creates an Image element pointing to...

Malicious code in @tanstack/eslint-plugin-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff80f01eaa71625ecdc195880a0c0f1ef71da7fa81d01422abf9634f74b5d6be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in openai-spellchecker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 13911c4c1e0334b4e4d972e3b3256a08f8991d3935d74086c252ed085d3984a0 The package hides code to download and execute a next-stage payload, which then communicates with C2 and listens for next code parts. In the analyzed version,...

Malicious code in erslove (npm)

erslove is a typosquatting package impersonating resolve, the module resolution library implementing require.resolve semantics. The package bundles the legitimate resolve source and test fixtures to appear functional while hiding a credential-theft payload in index1.js, executed at install time v...

Malicious code in yeahmankema (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e82095096c026f9ea1f8a44e7b94b0f9def1346ef887a8a6bb4e11aedc5abd63 Package exfiltrates screenshots and network information to a hardcoded target. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in eth-web3-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ab01b68589d4f3b1e8686ed007d522f24c8259049cb211a023ac3f3ff8f56ce4 Code pretends to be an ETH utility and exfiltrates the given seed/private key --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in crayrandomiz (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 70d147758fe5288bee2adc712e45b7836211b83ce0b209fd42a31e4b3696bbf2 Package exfiltrates screenshots and network information to a hardcoded target. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in camelotlabs-core (npm)

Five packages camelotlabs-sdk, camelotlabs-core, camelotlabs-config, camelotlabs-worker, and camelotlabs-utils were published to the public npm registry at version 99.0.0 by the actor madman0619 as a dependency confusion attack targeting the internal npm packages of Camelot Labs. The inflated...

Malicious code in ally-allowlist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a086e259ec0972dac4c5fa5c2e204b09c2158df4e01326321b84676837b85be9 The package ally-allowlist was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in update-db (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b606e43d802d06fa7b5d14f020e7727886462320dd05dca09c16887b15d5a37 The package update-db was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @tableau__catalog-messages/database_lower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4155e0aa6cc429c2ea66b3b131055983379b13cab66b74fa3c1758e83a48ec54 The package @tableaucatalog-messages/databaselower was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @logcore/pino-pretty-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a729cc1811bd1bc1fa94404ad4bcd8376c1a29b90311fd2a89efecff51fe592 The package @logcore/pino-pretty-logger was found to contain malicious code. Source: ghsa-malware...

Malicious code in eslint-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd32859b79bc7696823cfd3fb1a51a5036a19dd9e92b88f4c3cbc2d06fca8a9 The package eslint-validator was found to contain malicious code. Source: ghsa-malware b74db6c61aeb8e5a3729f1f8e311559e5203aab14dd2c8ec8c87ccb868a1ff...

Malicious code in technical-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb4466031b35e68c6b2433674215383e95538391f583e01c1800c758a61c53b The package technical-assignment was found to contain malicious code...

Malicious code in shopify-admin-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2d9c5f86ae6bcf7ba61b04fdb9a3a1f5972c1b157323851a1d47fed29486ae0 The package shopify-admin-web was found to contain malicious code...

Malicious code in proleis-web-animations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f74a5f037c0757513f368436996c6152eb542df054a16bd774b37d6c8970f84c The package proleis-web-animations was found to contain malicious code...

Malicious code in @augmentor/experiences (npm)

Malware detected: Collects and exfiltrates sensitive data to a suspicious webhook via a preinstall script. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4067e28e3de3f031541a3e624d8d21dc75777b65b83ab8aa4fd09bfd52038968 The package @augmentor/experiences was fou...

Malicious code in okta-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1968f15d4faab74927023ad015e009d98087c120d8cb31b4a754faff297219b7 The package okta-signin-widget was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/slate-serializer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb7716bab0bde17a29c041cd61a934d39d4717019743671e8d6164fd166c0bdc The package @voiceflow/slate-serializer was found to contain malicious code. Source: ghsa-malware...

Malicious code in @trpc-rate-limiter/hono (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86780189d32c5c6215833b83e8ff4274af92653c41f51d8cb8f9c1e5262bccf The package @trpc-rate-limiter/hono was found to contain malicious code. Source: ghsa-malware...

Malicious code in ganymede-public-canopus-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8666d987c2ffe04eca9ec038bd50b9769fb0d7618dc1d35751253b44ab3d5d39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pulsar-phoebe-apex-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e5c42f40f5c45ce556ed2565617986c5bca5b1f854d73a577665555ca50a2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in petrology-module-australis-apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aedf2a100eb1fc3c7c3a325af0c6969e95c447adbdebaba9a1c2b6f0b869ce3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in roti16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839bd37cb0af6379dbf75974527bceab813a0506658799cb6f187b054d51472f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lia-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45bf536e6cc82884762f6c4d22b3544151badf5be5a6d1a432847c426ed971f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-lokcek37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8584f7f71b9a5c5e500facfccd9c495c7c8af8838a015c3b31453536e0a85d08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hotel-lima-charlie-gwkmz (npm)

The package hotel-lima-charlie-gwkmz was found to contain malicious code...

Malicious code in nexus-ai-frontend (npm)

The package nexus-ai-frontend was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

Malicious code in monolith-twirp-features-actors (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis af5da19cc088c1f8c8715fafba484c4ae7ab890004b1f92947ee212b28b0abe1 The OpenSSF Package Analysis project identified 'monolith-twirp-features-actors' @ 1.0.4 rubygems as malicious. It is considered malicious...

Malicious code in fs-filter (npm)

The package fs-filter was found to contain malicious code...

Malicious code in com.google.android.appbundle (npm)

The package com.google.android.appbundle was found to contain malicious code...

Malicious code in @toptal/picasso-forms (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in worker-template-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06ee62f6404cbc2ab384a294313e49c9685b3f7a3251a4c9b86dd1d8e90dfb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ruby-lsp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23d59cae1de4c2853d318ad10197c82dc6f10fe194854b704b477cc20b271184 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wdpr-validators (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3603a1435c7217578ea596fa8e598c1a1a0bf6c955b1c4248b9c9978c9a1c6d4 The OpenSSF Package Analysis project identified 'wdpr-validators' @ 16.0.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in beautifulosup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d29c9780cfa766935c7a3be527ad99f08a1e5dba0576b80738b28dfa060e30de Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in @md-fe/antd-upload (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b542149e81bea611059ed8fa1900541987c8fcea126948c3ef6b31c986161ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth-balance-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5262abe8a739e9f893b3a0f9ce010d19304358cb843873f597ff90d79d619ccb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cacheable-request (npm)

npm/cacheable-request version 13.0.20 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases throug...

Malicious code in swiper_angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...

Malicious code in merchantprefsservice-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145fc1d224cc012a8cbdea5823b1573df6400ce6a24837b2c25710772152724f The package's preinstall script index.js executes automatically on npm install and collects host identifiers — hostname, platform, arch, home directo...

Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27087d7e447aae7f5009468024ead0904a706c36775c9a132b43bbcd47d3993c [email protected] declares preinstall: node index.js in package.json, causing index.js to run automatically on npm install. The script...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...

Malicious code in svelte-goal-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc009d2d22b9f02aa6b2cce1ac5eadfcb3f3a7d437cc2ba031eb1e6154da2a4 [email protected] shows no evidence of exfiltration, install-time code fetching, credential access, silent-relay, backdoor, or self-propagatio...

Malicious code in fs-extra-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397f5c6f4eb2cf734d5ee1afc9908bdd0162a91a2fc6ad6d7d51a5cfd22fdc41 Package impersonates fs-extra by copying its description, homepage github.com/jprichardson/node-fs-extra, and repository metadata verbatim. Its...

Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...