Malicious code in nottuff26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d6f3663bcc4d41d4ec7b7e07a43f82567efbbab2cfb098d7227f0f0803e7577 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4435156ef39093b21f7d28e37ef0445d66c02c6267b9c364d493a7856168f426 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4281f3e1363cd272d402582ac8d7bf2a0c0e0a75d42827a227dafaedebdc87d9 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in abuden29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bea5d30b04399b967b11ec631f4c69261a378c4c2fb07d8dbcae101927596ea The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fec8592c01e9729b2d3eff199c34b71f489e593a095226c95b237d35ccfcc6f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b37399115949eb936a5e60cb1e4bc150431211adb4c62ea0bb2ad7120bf5c39 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in bismillahitidakimas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbdeeb9f66b286397502ebf5d67dacf17f4cc4f58917fa9d201d799bb99c3e2c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ishowfeet10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4148b124e7ddd86ab1dd66865b0dad79d42d666a36a5e122f07e12b0d3029570 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in imillegal2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a225f0551d1cfdc2da755da6241bc992376b5beddd6bc0895ea816391556e985 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in sixseven4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dfd6ff82b27df8c8ecd3520e70b720e0ff6e6f4443e21d1230acebdfd032b6d The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

Malicious code in omglucidesotuff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d144d98f0e90909ee371acfeeec0ad2ffe44450335ddf7f7a58f71a53dc7b107 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in backup2-asd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6fe96add7d70ce5933988f1c78b934187e279d88618bd3f211de3d719177168 The tarball published as [email protected] is a Vite-built browser application branded 'Lucide' rather than a Node library. package.json declares mai...

Malicious code in backup3-ff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a32646e3ad3e35186f8344c19ccdecfd69c26e8047fc44b77c0516b644fd094 The npm package [email protected] ships multiple heavily obfuscated JavaScript bundles under assets/ AccountPage, DarkVeil, GamesPage, PlusBlockedNote...

Malicious code in @gt-test-exp/profiler-exp-00000008 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58eafbcbb1bc421e2f19f4539db3e76ca501bbde728f54b36b67b5292f073ae5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000005 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a719b12b0a3a236ece513374dd46b73a69a18f73c26e074b1fd13d5ca4d6da1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gt-test-exp/profiler-exp-00000003 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a3e4c3d7eb7ff7cc6100fdedb0043142f7cae8c4cc0b2a3f31f371c77ead14a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @db-tools/main-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d3b0edc39a389f4099895c647f0cdccbb08c85e56835670468e7a989b172e9f package.json declares a preinstall hook npm install @sentry/node && node examples/verify.js that fires on every npm install. examples/verify.js calls...

Malicious code in notify-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf89f8fbe4c3f9ae9494077688977f46c8b3f875a552054508ac5eec7b62344 notify-dist advertises itself as a pino-compatible logger/middleware exports module.exports.pino, keywords fast/logger/stream/json, lib/ mirrors pino...

Malicious code in notify-funcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b65341bde476af6b80e1fbaa9f9a844b7fdc023ef02f5fabb88514d88012159 The package presents itself as a pino-compatible logging middleware exports check as both default and pino named export but its actual behavior on...

Malicious code in dowload_ebok_superior_spider_man_1_marvel_collection_by_dan_slott_tc3wo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a5a7f24cc73eb6660c6f8aa878b15409e5036a661210678896c25fcfe1f7c3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e394751a822cba7556f9b6676b531a472c7c113da4458970b242b42df9d88e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chai-as-buffered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d136202d96267459c4bf3aaaf6c903d7bd2c491901b61dcf2f391a4612f951a [email protected] is a typosquat lure name resembles chai-as-promised; README and module exports impersonate the pino logger whose actual...

Malicious code in chai-as-align (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791f5dcd4f623d5301bc3abf922c5f0e4ff716017fe67d3673c778e9d31b0776 The package presents itself as a testing/logging helper but its exported middleware factory spawns a detached background Node child that runs...

Malicious code in chai-secure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4253b6520b80bd3c3ee724b9766c67a3a2d7abe074ee57e15d5b9b270bf74f55 chai-secure masquerades as a Chai plugin offering JWT/XSS/SQLi assertion helpers, but on every require/import of the package, index.js unconditionall...

Malicious code in @wagni_bot/solana-sdk (npm)

The npm package @wagnibot/solana-sdk is a supply-chain credential stealer disguised as a Solana SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Malicious code in @wagni_bot/bsc (npm)

The npm package @wagnibot/bsc is a supply-chain credential stealer disguised as a BNB Smart Chain BSC SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...

Malicious code in tronsev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74ab279920219404ed526a79d48c3e9135856fd7905a135ce506c1c148557500 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in n8n-nodes-barcode-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb55ae2b864b933ae071cb33e8f53a52005ff0dc26487d15639f3b07fa7d9849 The package presents itself as an n8n community node for barcode generation, but dist/credentials/BarcodeGeneratorApi.credentials.js contains a...

Malicious code in events-alias (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 164642716a755117674746c1c2534b0ac47d56bed2348e7a800c3d37a98074e9 The package's preinstall hook "node index.js" runs automatically on npm install and executes an exfiltration payload. index.js requires childprocess,...

Malicious code in rony-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873cd33646b64f2073cc37ed9649a3757fb8aa186d50f700cb8ad199196fd56c The package's main entry index.js collects installer identity data — os.userInfo.username, process.env.INITCWD || process.cwd, and os.hostname — and...

Malicious code in manom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c719a4493f261eac65f57909044b1f958860f46fce1668314878007d2625849 During installation, the package exfiltrates random files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in paysafe-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c21a6e3b2436241fa7cebb029cdab33b2eb530cf450f7fe89d79a925c14148ed Package name and metadata impersonate the Paysafe payments SDK description 'Paysafe Card payment processing', repository...

Malicious code in @whs4/whs4_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c81447f382f370870e9dccf39168ae4d5b8105b5a94f04c7b541bbcc43598f99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in win-env-setup (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in wallarm-design-system (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vubiquity-website (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vscode-component-explorer (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rueactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rseactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rneactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rkeactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in remactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rei-internal-logger (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in rebactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in reacytjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in react-datepicker-next (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in reacptjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in reachtjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in raeactjs (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in picnic-work-app-terms-of-use-nl (npm)

--- -= Per source details. Do not edit below this line.=-...