238402 matches found
Malicious code in @user-interface-common/common-styles (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
Malicious code in @mntv-analysis/workspaces-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 65.11.3 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', whic...
Malicious code in @newspage/lib-ng-async-routes-ui (npm)
npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In version 99.99.4, index.js sen...
Malicious code in npp-ml (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac13184b04573151fc11ac8de28c384f016b49ed76d8689f46cf5c24909feca The package's setup.py declares scripts='bin/python', which causes pip to copy the file literally named python into the installer's script directory...
Malicious code in @zanta/baileys (npm)
This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...
Malicious code in @yudzxml/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629ff06ada2390b75e4ba41304b30289746455bba454c455d04d7743f6998974 This package is a fork of the Baileys WhatsApp Web library. a static rule matched on keyword co-occurrence in lib/Utils/messages-media.js:...
Malicious code in @xrelly-stack/bails (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 195817f808f7604633cfab5e678aea8d4bb53f116c72605d9a2f0852834c5ae3 package.json declares whatsapp-rust-bridge-baron as git+https://github.com/7ucg/whatsapp-rust-bridge.git — an unpinned git URL with no commit SHA and...
Malicious code in node-telegram-sockets (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222b22669330f75e779595b40bac9e2a842ef38fad691aaa46a0f4a615a55fc1 Package presents as a Telegram bot API client library node-telegram-bot-api family. a static rule fired on keyword co-occurrence in lib/telegram.js a...
Malicious code in @wanzxlonelyy/bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05fbc39cd82cca7d65bc1220f85315d4ad6584a5f28a9ddb0e38744dbbd9c644 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @wanzlonely/bails4u (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @wanzlonelyy/bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b1103787a1c723a0e4102acd15834c5420336480aec1e6dc37ba741937f735a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @wanzlonely/bailsforme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1d20a942a9977d81d31c2c6e2107befe05ef40ea0f60363afb3132b03eb29d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a36c9cf3f28683672c6c3bc2ba38d881dec1c6bd97e72e2bf13e29ee76604389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @wanzlonely/bailsme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f3eccacfdf2ece39dce55b7c1ba8330f39be88659053a43713fb16e39b6e2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @wenzyx1/bails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @sanzoffc/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2838d53888242c50e19ce80fc949f25a34de59a1282fc3631abf64a671e7afe9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @sakataoffc/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @sairidev/baileys-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @saazkira/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c02ddff50116449dec10c106e58ae0c84f16919145b8e13ddea1a23b0f00e9c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @saazkira/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 716e747d34d02e4d4b2d34558753e65ce26a72e086b5c2388427d22eb2b0e969 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @saazkira/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @revizahoshii/hoshino-fake-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bda9c3c386df18faa88110fc1cb8aa61654547c70ea0b3e970735dd69f247f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-wam (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ae1d092716881cb0e1374342f7fe125511d3a712d0fb5a171ea4e859650dc90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54e78d94690ef4e2d415c7754cf5e87fa9585670df0485bfd467a58e71a8afa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-voip (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 505d5a8535239db195966648019eb5584f9add49d96347a260c4d184c81e08ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-mcp-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9672a5dc6f8c45d8f76743e019edc248d1ba5523560bbe6e2a8185bac64b668c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-store-mongo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbbe1a1b8523eee7d05bc6e5c5dfa9e65fd25e1c42b9fed34f645048dba47b6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-store-sqlite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5be1bfeb40b1b25c136a73036ef88cd35ed77e2662ca3e69235b4c3b081ff9cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-store-redis (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 479c2ff94e78f7493a07e739eb36adc5eba6c31d7e2846a3ecea52d04dd3aa9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-store-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 413598986f6891c8b092769e99f8995809b19b477eb3dff36899d857aec516ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/hoshino-store-mysql (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0b408e63765025424d6570c3bd05bd6e01534734e6613fabee59696d11d1f15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @revizahoshii/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @revizahoshii/hoshino (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @revizahoshii/hoshino-media-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65fe484d1302a25cb129e7fb56ebbf059f4c9469a85abc10ac695e605e34dcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in baileys-xbats (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @alipclutch/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a547c784c13d1a96d07b03039a8997721e06467bda6794a2a1cc14a2cb68ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @fhkryxv/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @fhkryxv/baileys-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @we3js/framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b363085b57cf1cfd50b00e3845bdd50122e4e2f137a124def03f5cf59e7b23b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @fazzcodestudio/fbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02d04f078ee45b434a2f48ebecea2fc18811a6830ab2e24baccea6e577baa0e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @fazzcodestudio/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d9a7ab4b8ee5eb018dda5e7d3b273e9bc690364e24d4ece93d1107cfa791d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @fazzcodestudio/wa-web (npm)
This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...
Malicious code in @fazzcodestudio/mediaformater (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2777e6e1aff40e693fdc759b07014c5ad7c6b24fbd40d3b3cdb8d2f32c6249ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @badzz88/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eafa4b306df1ba72117512af8f1b676cd101c93bac67d887418f318b39efcc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @astracode/byles-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @modss/libsignal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78daaf334cc6740c70b214309f4bf742a863b8c3c421076490cdb84790dd9550 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @mivesensei/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @mikudeveloper/grace (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
Malicious code in @mikudeveloper/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4749ec89d8c51729fbd97994a6a035ab229a56bb1094c4c47d9a3d68df050711 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @lekzo_dev/amprem (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2a03e817ffe43fd777ac600302898da7b30ad7653e1c57bea618e9801dba3b Package presents itself as an 'Alight Motion Premium Activator' and exposes an API that POSTs caller-supplied email addresses and 'magic link'...