233081 matches found
Malicious code in claude-code-base-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3000eab5b77e9247ae3dc1125384eaeb03ecdae7ecd17fe30ee6216a6a87c686 The package claude-code-base-action was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in @citi-icg-158830/elemental-chameleon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 698e88fd9d64450847d476a41187198acc173deacf9c5484791a4fdb6fbbe969 The package @citi-icg-158830/elemental-chameleon was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in apexomni-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24e9d6ad71ac3eb0c091e0d70625e7daec5ed0352e8b8a4ed2273f2563aafad9 The package apexomni-node was found to contain malicious code. Source: ghsa-malware 7412ab94dec4136827a9aaa0f414452c3bbf8f23b2ea6820b29a1b4e8cc156f5...
Malicious code in venv-utils (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9af11c23295a9a592b6fd62d62490669a752ab6dc6c0b755ebd068ec6371375f Package contains code to silently execute a RAT-like agent, allowing the attacker to access the file system and execute arbitrary code. --- Category: MALICIOUS...
Malicious code in marginfi-v2-ui-state (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e11ff4ff1afbd9d61e37dd14e75ed54936d435bfc765683e33f8b24976290db7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in marginfi-client-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6239cecf8f2a6600aa98aeec2042d29928f02416181a88f31a251b0448327fc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in chia-network (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7439a1ad4a50c3852597bd31aaf7a3f15c53c2cb9f124b9b350e55517b5f592 The OpenSSF Package Analysis project identified 'chia-network' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in github.com/BufferZoneCorp/log-core (Go)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...
Malicious code in supabase-javascript (npm)
Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...
Malicious code in always-updates (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee16a964c16035579f7be2f965a801f87876080603f389e1e75ec3073bd5c2c The package's sole advertised CLI aupd, registered as a consolescripts entry point to alwaysupdates.main:main executes...
Malicious code in justenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b391e2932f5ed4a24b376c4c9ac84c98b88764799b6ddccdc68e19964346228 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in jwscube (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 325d4311f3dd1d82c8f9ee1ddc19a767eb69adf0a338625c8ce1e9d40062dec7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in projz-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 196ea7ee7277857a29c8478e6908961bde9f28aa136c3e6ae68412ba4b67bff0 The package routes authentication-related calls through a hardcoded third-party HTTP endpoint and then unpickles the server's raw response, which is ...
Malicious code in guan (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e04a9a658bc7616e72a5edf276dd049e5b697f2492c46929caf2e01fac95d84 The top-level src/guan/init.py unconditionally calls statisticsofguanpackage on every import guan. That function in src/guan/others.py opens a raw TC...
Malicious code in @mesadev/sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 5e1924464368f0c5816ee84e000cc47017f44045140feafbbc9e685d847ed5a5 This package was compromised as part of the "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials...
Malicious code in git-branch-selector (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dab170d586455af0816362e715de0907ddaa19adb87c68ef59255139322dde69 The package git-branch-selector was found to contain malicious code. Source: ghsa-malware...
Malicious code in @squawk/airports (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01fabaad6adcf6ba78ba71fb750d70c8e3f3a1e524a75a6b8bf8ddc7769ac5b0 The package @squawk/airports was found to contain malicious code. Source: ghsa-malware f8adf8853b03c99d84b919062f8c688b4bfb42f72cc9de33299fe3e3f9a2b9...
Malicious code in @tanstack/solid-start-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4905d7bb1a4d6f69ec73fe4cc8fa958262fcab1397fed5725ac39db447f6239a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @tanstack/react-start-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8358ce998650baf1a9cb6bb602109da81268c43855ad0b16f892687cc89f104d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in xxx-bale (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1109b5dc74c94551027044e54e20f9c1c18f89d53da6af87861ba4773eae1966 The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigge...
Malicious code in web3-py-checksum (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4b2052172f5c854b2e91f6bdc9336a97469cd161372621a1880d9cd1e3ad426a The code silently exfiltrates the private key of a crypto account. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...
Malicious code in wallet-scanner-pro (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3c24dfc47c3ee1d37f4d7ec65a43d1f861422d7fb3ee6f8e8b6e6a85fe2b5120 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - Th...
Malicious code in tron-energy-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 84d2f533c52b85d9b3b4c27fe3863e57365308d49b7a412038b26047e6704450 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - Th...
Malicious code in solana-scanner (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 047a41b9a67bb975c2e98b31b5e13875569de5097f0b61bb5984e300687e03e3 The code automatically scans the filesystem looking for BIP-39 seed phrases and data indicating private keys, and exfiltrates them --- Category: MALICIOUS - Th...
Malicious code in puan3 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 531ab02814e67f81e5c82fb57b72d59c3972d0975932f6e9d00ea680040e9a13 During import, package automatically starts a connection to a C2 server, exfiltrates information about the host and data like the browser's history and sensiti...
Malicious code in oracle-lag-sniper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 052e2309a320b056b5a959c33b703d819b1fa2ce9b2647d250bc612d25bae9c9 When using the package, it exfiltrates sensitive environmental variables targeting Polymarket keys to the target controlled via a Polymarket's user profile. Th...
Malicious code in bbranger (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9cb5c90bcde5bf7b63607d4bf5e7be1ccb7b5c9eb2eb92e32dab102be5df3687 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Malicious code in promptflow-runtime (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5b42466489944454bbab304af3aa9869e3f0483cafc76b4da896f6512bb4c627 During import, package collects basic information about the system, performs deep fingerprinting, and reports the data to the remote target. The package...
Malicious code in eth-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 843cae77c9aaf84bef1b7d5e46e27795d5203d2959a39b2797f0e1248b4995c7 The package eth-logger was found to contain malicious code. Source: ghsa-malware 0a6575daf349a893026eed02c1231af4cb31b0c8acbccf9ab819875af89625b3 Any...
Malicious code in @ataslkit/profilecard (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efe1bf5f3d6ed3259b1ef3d48d73c3fd6368a50097725968869b551e73f828a The package @ataslkit/profilecard was found to contain malicious code. Source: ghsa-malware...
Malicious code in centralogger (npm)
dom-utils-lite and centralogger, with identical payloads. On npm install, a postinstall hook fetches the attacker’s SSH public key from a Supabase storage bucket, appends it to /.ssh/authorizedkeys, harvests the victim’s IP, username, and hostname, then uploads that metadata to the same Supabase...
Malicious code in ih-icon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e7f19afb6ffd57012c61c6bef2ce8ad4238f192cac0679e216684a37ec672e The package ih-icon was found to contain malicious code. Source: ghsa-malware c7182707ae8272b3af4376c3dfec66a3b574b8c86217bf3b7c705d94dfb84b63 Any...
Malicious code in sjs-lint-build1 (npm)
sjs-biginteger typosquats big.js on npm. Published April 7, 2026 by throwaway account vanes.s.p.orit.a, the package ships legitimate big.js source and hides its payload in a dependency: sjs-lint-build1. On install, the dependency’s postinstall hook fetches the attacker’s SSH public key from a C2...
Malicious code in kube-health-tools (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4d36d5ed9b1bc15c12e89f48c1228a4f6e3aebe558a67d535655e280b25b4440 During import, the code download and starts remote executable that later connects to a C2 server, likely establishing a reverse tunnel. After executing the...
Malicious code in coredxloader (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 b26408ee7735357c61e0a81e60620000999ef84eba419797b20858e5ce5b4a62 During importing, code starts a malicious script performing exfiltration of sensitive data and credentials from e.g. browsers and Discord clients to a remote...
Malicious code in lakeflow-community-connectors (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 931d6183e0dc407fb2c14769dcebb7d1845f4af9ca0b26766d75d783b5611165 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Malicious code in onboarding-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d4a1844921cebc245e39614ba7b999c3890d048ad81429d89d9daf45038ecd The package onboarding-server was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in ecto-spirit-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72d3638a38fd250b18d9b93068dc16f07d03d34e87c361a41069ac57740f2629 The package ecto-spirit-core was found to contain malicious code...
Malicious code in ecto-registry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b394438461d34fc5c46660addaa8e99dad23d16b7050b1e8635fd7c700ae723f The package ecto-registry was found to contain malicious code...
Malicious code in azurestack-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 500acb5021d6cc7c40146b6b6f8fd17563f17b68d95e52d78a749514b839cba3 The package azurestack-common was found to contain malicious code...
Malicious code in @pypestream/floating-ui-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c054f1bdbe451e796bb0623296f4240c654e72b4ef794089dad3428bfed98fd2 The package @pypestream/floating-ui-dom was found to contain malicious code. Source: ghsa-malware...
Malicious code in yahoo-commerce (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3725b1c28bf27cb9ae988e61fc0c7b790b588587cef59086e7d63460f2241a9 The package yahoo-commerce was found to contain malicious code...
Malicious code in test-bugbounty-package-6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52ee2c6095d9dfd6bdd4945e804a736035b9e29d4265e6a0e455aff026911be7 The package test-bugbounty-package-6 was found to contain malicious code...
Malicious code in solana-gateway-contracts-private (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c99f3ecaa102d6db90dbdb52a98646914489bb992e520c1b527380e7c9574a13 The package solana-gateway-contracts-private was found to contain malicious code...
Malicious code in smm-yt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d0a38085e1e5c5be475b6ae3387d915541a3aea8d1b8ac6869a1125f3c47d0d The package smm-yt was found to contain malicious code...
Malicious code in signalk-poc-bug (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf69e2f2bf99c9fcd93e12139a947e034130e9f90b30def5cf03d008c3f40330 The package signalk-poc-bug was found to contain malicious code...
Malicious code in proleis-web-file-input (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245fa1a911f89e0a94db5dda7b80b9f2b64e0bbbbfeb9618b3e013f4da4f212c The package proleis-web-file-input was found to contain malicious code...
Malicious code in player-common-controls (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aef58425992286c8ee1bba6bb26ba161a52a852bb7ed8a6087e737b91d02e8b The package player-common-controls was found to contain malicious code...