Malicious code in sap-mcp-facilitator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bfa674a61d22c14e8a76f398231dc1a1052b02fb635dcccc2e72f69565eba68d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in maximumsats-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97f5b15159d700da1bba2acd235f675c5ef09636644f47b105ccd48648c9b845 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in adpanel-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2ee116a6f3b542c8343e89be717fad00ec4605219c7d821f68aefe36610d4c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29aba22b06501282c9191dcde7722b72d3d8f5f998ee0745dd99ea46eeab6fb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in attio-discover (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5820492d27701cd3054e65446532aa6542f431b1340d40e5b0332bf588dd67b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hazmat-cfr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d2d599c1ab0aeeeee36cccef36e04b2e89220aa8078c379df1b9aef50f55aee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in capacitor-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b3684fbb41e490eea74489dc2453b1f37022ced6d2fba0c72a82ebbc42f4f80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kip-mcp-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58ee4dff425171e92697968c9cb459175ab9826c0af98e08452458251c9c58bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pm-claude-skills-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc0f6d8952f1a97d549799a1e7723dba7a9907b72b0c7a4d097776ddd1d8603 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca3596032239f2a982b11e2846e8af25975d77f3f7c211a32f68e5a451ead883 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c29928c7b086fd3efb53a2f1850b92a2f76f6e7e54f037fd2b87632b77208fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac64235a2bc0c05f17f524b335ed7277658194e8dc3394597f2baca8eb17f7fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polyprompt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c83b81c4da433d42ff97456ac6c52970f52de665ee78be41fd4c4ee34705adf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6d0c7798c31f2743649318d78a1937fd28af9e4c28a2808046b647f2c087568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in routerbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bcc3239685adaf9098cfcf2a9f30c0018357be5ad058caf2046534c516bc3a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 647eefd97b5d8a0eac0be938122ebe0120152f6ded442d7616b18707bd26ea65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iac-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64524c7a0044805e503f398bf4e7f890b40bc3225a8c7576cc71ec9c8a94e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asdk-plugin-ai-platform (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ba38202b0196fc58518ffc2cb0c0cd9067da9fec70d6bb371119b8175893b416 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in asdk-plugin-alphagen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d3479f5a67e780468835828895609215d82aa5a273dfc152e4bae5a12f21a245 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in asdk-plugin-legacy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 65dd9dd087b805a16fb5d68c92cf2be0ec28fec162d75bb0eb81bb8d9bcfb61a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92412016c9d8c246f1f14cbe2b5efbba127ebdc30014f874baf5521f115663cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vite-tsconfig-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47ed169858113da45745f7c69d04ad81103987d8b1213b2c98024d878bbea0c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rollup-plugin-polyfill-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55b9bd8da2181c7be27563d32bcd51eeda41395e0a1660c736840cc94e3613b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fef68e7a34cfe91649a86535f07fa0373d6231d06a296f9b7f3b3a4c47ed6e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @0xlr/question-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f892cd190720c7c8f07109cfcbdd37f66caf5065ba5667b5be0800813dc0cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @0xlr/dep-confusion-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a8d7af3dbe17097e5afc32e3f155b7b7593dd51b5bf2e035550f1b952912d25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7a5376398cb81f79bf581819bf1f7fad54a6e3feaaa7ded6d3b418d4562c47d5 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a11e86f01cbd23fcc0453904b7991ddaaf87582fde3bcc3b48686a28213c46d9 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

Malicious code in walmart-genai-trace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e84b4bbb5660ea5c7f803c4e5d0b12dfe41c9bb147fd2228c72bdda2224291a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd7348ccf6d30158d05df90e15ebba938c30119c83b2ce6679cd69068dc667b In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e0cdc137d19f19df47efa6fae6d52ec6eda48eb2f1915ac4eb77787956d10aba In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f2900cfaae06740bbefca375a4d23cb6c3dd67726ace0f9cffda92c04f1c4333 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e18e6e4016bf07f11edb272a08fb26268b2fbfe0b42a4ba502df368ce05b01 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2d8df53cab9692399da989640712189aa027dd12b62e4fe0de37d76aa8c116d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rollup-plugin-polyfill-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58f0559ad4447885bd5ef3581be2e97da6b7c82cff4c628e1e22606cb91d0228 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in reguestsc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20e4ae2ce79408a65e9b4bb348c2d69e20eb6072e3641531e2ec5773f1bbddd6 Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer. -...

Malicious code in @peptide-packets/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0bc181dc4391ee3b974bfa8ec4aafcf982c6bae5f7d9e6850d03d25293cca6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @peptide-packets/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ed13c11d0b10dc89a0cfecc6445f8565e925f91b1977cabd9397bcab2892b3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socketi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f02e02642c533799ed96fac51f973f65097eb5b870dc1a0ea47e2fdcbb70893 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in soccketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fc9cac2969243ba864ef1645d5d99ed62e8e4906bc58cd32cee3fad42c9c528 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asdsafsafdasdsaasdasda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25b27c7f8bc01a49e1e5d70500418776736b948710b1f4c5bb91b3265957d46d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eb88342ad8df3fb45f8f72935ab75fc8c7f90f185467a741928f1c27f653cfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in passsport1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68604126507bac849b697119200b6ef37f408aaa077f208ae0127605159a9832 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socktio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb2387c455cb19ae4c050c6ae6493e1f77af78385fc684ed7bad4c2452b3ad5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mongostose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f6ada9e2243bec8a49064b3433e766f098fd22ec40cbab730e81a5d6354abb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in asdsafsadad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67f3884787706e55b04fcf9ab0749dd3f91bd1f8a9d06bd86180483dd9f581cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in passtpor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e427a84573f9d6512d302e4f8ffc7c1011e5b9d337f4b084da29c797ce25b9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vcse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23149b92d10aaf504452f58832dd63804e33639ceda81871c4188295d3d13117 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in moontose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d8d632d57584e0320f3bc47ad4d13768be553c24a711c602e7c865be17a614 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...