Malicious code in avail-able-albu-m-down-load-6807-yo-bum-rush-the-show-tq11q-lqcaye (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d92654907f56ad794394682d8b26bb6fb8f26340bd5f090730593fd9fd326798 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in a-vailable-al-bum-file-19105-filles-de-kilimanjaro-4syt9-khnipp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8698298e3490944b1efb024b0c0565f3f177261b887395bd4469b0a3db772e3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in a-vailable-al-bum-file-30258-secrets-of-the-beehive-rk1pl-vebirt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 711a60021cd8fa5baa56abf71a1eb5e317d5fada82562f8bb1c413542b587ad5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mp3-file-zip-d-ownload-48120-lost-nation-road-0cibe-ynawhz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b46450dbe9541d268f8ff08a5d94671796222a3cda2686dbd030ffbb6ead4ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in do-wnload-available-2013-5195-ripley-pine-zoryg-cyvlnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab47b050c80fae9e908b2ba52197ed2682d054410fe78dc51cecb93dff5b2d5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in do-wnload-available-the-white-stripes-1-yywrn-pvfqxa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a5d812157727bd1a0218b766e1c6557f97493da83abaf8b746caad5285b13b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in availab-le-alb-um-zip-211740-city-burials-xwcy6-bhxnvc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0e280d968e65e1daace58bcd9a2d2a304bd745a398f8bc6195cc1108bad653d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zip-mp3-a-lbum-do-wnload-new-392999-fantasy-island-wlvf4-bxyvtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be713b34effa4525fe877715b47642a38f2c539a1ede69d96de63af66e942b7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in a-vailable-al-bum-file-the-world-wont-end-7io2n-pbncia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8a3de985ebc9e2a00f5373d91fa6cb4289d523f15eedf107dbc88812770218f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alb-um-availa-ble-zip-mp3-file-43838-stories-of-the-years-sslgg-bqfcko (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d116e3e21a54c953174cfea5d38e38c41e5681b3182c2bf04410029693a584c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in a-vailable-al-bum-file-2015-39171-harmlessness-khwlm-ihtwah (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44e7ca3c4d507aa771d14fbc0799332e839a84404bd26ce164b5902c998fbee1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zip-mp3-a-lbum-do-wnload-new-67476-what-we-do-egj2h-bgfgzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a07066760715a68cc497490838eddc10c29b0c18af03a3df58114679dba0c0a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in down-lo-ad-now-zip-mp3-116827-chaos-is-me-rj9kf-abdorv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89171ca04fe46b4d4d48fcece86af44df40edecf22fa8f82ad244f737cd31243 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in down-lo-ad-now-zip-mp3-12737-talking-book-grhl4-lwvpqw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a03934a286d0700768ce8aa67240943fe0772bf20322386f47d78c5eb0c1e79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in down-lo-ad-now-zip-mp3-6140-the-ideal-crash-jysrl-jcdvdw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 413bb57ad4c5d6d8207af5cf729b511eebfeb944615465ba62be784ccee2a9ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in do-wnload-available-f2oap-wvzhe9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f11ff9e5be5fb573f62f0c0f417b240714d84c49133dff475fb41b41213bf849 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mp3-file-zip-d-ownload-hearts-of-oak-7cyqu-oiygcz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74975ac076a1d390227e09308021132195615ea9e569d6320a2d04d6ef51ffdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in a-lbum-do-wnload-avai-lable-file-36733-tchamantche-9uiic-rfzaip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7da7a677624beee237b4a10d035455adc4b9475ce9ac87eb54ad9f9bf00b7f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in new-al-bum-av-ailable-girls-can-tell-ccfoc-vmqodd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c77833ab4e55ec9f565ed75b72ce20a80d8dc51fec19e2965609b881e48cf2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in a-lbum-do-wnload-avai-lable-file-2019-138062-i-need-a-new-war-pp6yu-vclmgu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58cdac851d9895a1e03bc1606c6bc0edca565bf3eabb1166ab3495a948911b99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in a-vailable-al-bum-513977-rant-in-e-minor-lybr0-bdhlsb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaf4a9b8797a44e404e0191319882ef754eb4881f5a1cc40868b811f37aae2c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in new-al-bum-av-ailable-131000-eton-alive-qzngy-cjxczf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 951f0ebf686b9d2ba81a5056209d4d78a0348ae09d22401b544c5054606c436c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alb-um-availa-ble-zip-mp3-file-6053-the-specials-giqmz-flbewh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9eccc0208c328a4c0e6b718a982268822d174d7575713c3314230f6df93009fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in availab-le-alb-um-zip-the-visitor-l1n8t-frzacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efe181fe88827b53b10050931ce484b5a37d471ba7eaf171c7c60eeb2c69de3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bs58x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a128d8d165acbbd45f7a6df88af9891256acebbc0880057acb0f94d5e660ffa3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bs58x64.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c6696aeb224149fed15d3bd864172571b55424f98466f6876dc51ca75063d6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in base58x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f37e6f705f32055653dd567f05118434eec1390d9961673981bb89bae11eaeb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in array-inline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8909a6ff094fd04116daf7c014101e9b002e9ea6e6456ff7ab5faecdf1422e1 Package [email protected] was scanned across 5 files with no a static rule matches and no traced behaviors indicating credential access, network...

Malicious code in array-inline-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56155285d4d49f75322eac616667d54fabe1c19efbf500a0cd631c479380d5bb The package contains a small number of files and no static or traced findings indicate credential access, install-time code fetch/execute, silent rel...

Malicious code in dsjklweuvhgsdcq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a374493c76cce0d4d3b1358003a3fbbb6ad103113a386966045d5bae0892a82c The package contains no JavaScript entry point, no lifecycle scripts, and no dependencies. Its only shipped file is an HTML page titled 'Just a...

Malicious code in ticketcathayoct12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6b742bdf2b31258a3708b4ec5c395708e8112d9b8616d7d97d21de8b73c9ee3 The package ships a single file, index.html, which impersonates a Cloudflare 'Just a moment...' interstitial and embeds a Turnstile widget plus an...

Malicious code in mxckjdgweuxpsiohd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5aef67c54559d47c77f1f78743ae13456271bd6343674a14976ca7dc3132693b The tarball contains a single file, index.html, declared as the package's main entry in package.json. The HTML impersonates a Cloudflare Turnstile...

Malicious code in nsdhjuiwqxmhsf1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9259b9f77730ae281a5467d21626b8ef91c6c41200acf321b28968b3d36c241 The package contains no JavaScript source, no TypeScript source, and no install/require lifecycle hooks. The sole shipped file is index.html, declare...

Malicious code in vjkpwjxbvndelta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b99400fad276cbcc12a4378e213d162e7992291ca714f3b410144f10d0c0ccaa Package contains only index.html and a package.json declaring main: index.html. The HTML is a Cloudflare Turnstile 'Just a moment...' lookalike page...

Malicious code in mx3dxhgic8xhd6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4fbf379ad5f6f1c43cb74ef7fbc66e56fe9b0c0edeaffd1f51bb9e5558c2bb Package [email protected] is published under a random-looking short name with only two files, one of which is an index.html containing a large...

Malicious code in zxhgssiyluwxchn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4ec9075865f87bed709b7be203b621244e13b28d84e8bd47586d2df02e30a24 The package consists of a single index.html file set as main. The HTML renders a Cloudflare 'Just a moment...' Turnstile challenge page and contains...

Malicious code in ichigo-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in aldi02-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52aad2c9e9c773ff8cc1529316069d58541e3fa677cda7ff75364c644154eb59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aemath-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4ba11c491c52f6a459598d106fb4a592940ca56221cf5795c47f998bd5009bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zeroz-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7be2199641fd598bfa6c6a11fac2567fa0c50f3f55ae3a8e8cd9ecd6ec4bf20f [email protected] appears to be a fork of the Baileys WhatsApp library. A static pattern matched on keyword co-occurrence in...

Malicious code in item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21768e52f5deae2143dcb4b348368fb1a07efa47856a868a24a0977a52889ce6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rubbydev-crash-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in prastzyy (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in xcvrenzcompany (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in prastzy (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in xzbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in xzvexpzcbailey (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @fmr-ap149494/apex-base-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e582d9d611f75576135d06bf83cf71b60a58fbbf475ba61e656bf190a73c5546 The package ships only an empty stub index.js exports and a manifest whose sole dependency, ltidisafe, is declared as a bare HTTPS tarball URL...

Malicious code in @fcsmc/commercial-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdca5cebb5734d25233e8016eb494ab6ec1a099899f0814fc846e46ad351582c The package ships an inert index.js stub but declares its sole dependency ltidisafe as a direct HTTPS tarball URL...

Malicious code in fabdeploycheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from...