Malicious code in garvisometerui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 09877eb0403bbdcc0057b40370627c99965eaf5b4d8215cc4b23ea8c089bc9b8 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in voxcpmttslora (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b40228df9bac54fb38c660c1a82e16e409a25f416bdd35e4d50339abf8891f2d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in qwen3ttsui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2c64f86bb29e534513cdf30a837f2ff458b45eac42c8e35f191b952481ef7c3f This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in @i18n.site/cli-win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8daaf422b7b508768f54150c2544bd15ac254dc1d2de5639707eaef08b7c49bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in my-mcp-server-driving-license-ocr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f389c95da49d7d8358b52ea58ed6dcba6ee9cc9f1d441dfab7a9a3eb1b0989e The package exposes an MCP tool analyzeimage advertised as driving-license OCR. The tool accepts caller-supplied image URLs or base64 image bytes and...

Malicious code in fetchium (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5b286fc27984ad73cb490d8c5e92be039af62676f22a75c500c2090e137c318b During import package runs an embedded malicious executable. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in dashloom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909 This package is prepared to be used as a malicious loader. It pins pydash dependency in a vulnerable version allowing reaching out of the object scope when...

Malicious code in basek (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63 basek 0.1.0 is a Windows keylogger shipped as a Rust library. The exposed getdata routine polls Windows key states for alphanumeric, function, and...

Malicious code in hesk (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391 The crate ships two reachable async payloads — pub async fn dat in src/test.rs and pub async fn bs in src/parse.rs, both imported from src/lib.rs —...

Malicious code in acustoviasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1b7333093822a9bcb12475b4f9a7e57dacecb962f9157f2b67f53ab7797f085d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in @hesxo/forge-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b541721260dfef499396c5e7ddce0284e679fffa6abed53153d765318fd78710 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hesxo/viro-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cca2ee52335e4cf061ed32c77fca91619828007bbde4527f9078af124ead3426 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in depfix-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8aa4880470ce564cd102baf4a4da6ad7923cb9c4cd50975e927a4a274bbcde67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in otto-git-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5c8eadd28f7dcc587c399947b45b621d4b5def26e58adf156ecc0f736338718 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ferrotts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b9cf8d8b5adcccc1d9d9b99d8148dee71751f256afb19962e88fa58cbc8ad71a This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in flowmetry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3cd9c2027e6d2cd6df943297bb9304a6190ad887bc70ae8477ee81697006b889 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in garviscope (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b9a85e3733b61731415cd2c00077af90475fd10d79833c025013a7f0b966ef15 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in evalometer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5311054d0bb8bc91f2121df374d526ca42459a664f15198eeeee4133cacf6941 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in wavforge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e017f6da32e0eec5f8bc75486e5bfb1b016bffea08ce26fb715e816de64ca7ea This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in phoneliasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0fb66d50cba21c857c53f0336e328c0d81eb1aba12a77b17e29f3e818302c1f7 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in garvisuite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aba6c4e4d80dd609e6858233c87d8491d40516add07e3bafc8b9aea5f6baa896 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in lumitts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c1093eeb37afa2ce37481f4c7bb25156eded3eaa1e847e63cb141620b8e41550 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in spectrova (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e8a78fd42fc449cadaae37c314b15fc82adf945a869f636718488b7e61baf7a9 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in voxgramasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ada38683f334fda70b705c68576f12fe0bce098e47837b983e8e92dc4e51e12c This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in voxrelitts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 519830c724d27578cd9be64f1063a461a1f12f3cf7eeca1a0bf3b01785aa7624 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in stackvane (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 45bfb9eab4765a149f6e3ac7c08c09236115073f1b2df8a9919a6f91ffd86600 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in melstagen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ac28e45b20df71fefbc8a6294c7e7a202f42b356e38dc49b0e28f335fb9a2737 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in inframetric (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1dfe7ee88510cfb327969ba6fe21e6dda575abbe6f2a8f7e2e4174c8a58384b This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in eulaliatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26264ebade1f8ffae1a24c93ad17e82008b388609927b61132f46bbca94159ff This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in @rclaude/darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a04c69fab6f8174cbdaf13a74bf088b576d39732febab52ff6c74afd2de9855a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @brunosps00/dev-workflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b262a2fb9df42da360022fd6a7767e75e2ad093cee27a157fe9b82060811d55f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in future-scripts (npm)

On October 10, 2026 local time, boom calls localStorage.setItem'key', i 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges calls boom before input validation; the bundled source map confirms this path. Version 0.0.3...

Malicious code in pentest-copilot (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32 The gem declares an extension script mkrfconf.rb / RakeBuilder that runs automatically on gem install. At install time it collects installer-side...

Malicious code in @csp-frontend/dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48723231b0a1e6148357f5144b07fecccc2a68e442ad0bc5b03aaaa3136d1a6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @csp-frontend/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6d7b7c625fd2fb5d7d2ced04961b10ad3c90b45d515afbdaed838d3bc015767 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @budetzz/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d769dee6e977515610fc17a1d0e5cc02f0a723b452be80b4788ee4e0e0abf7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @theguyswithaball/scrambler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b900ffb882f993399c4a8958c1f144751bf2d992a99f8fb6636817b6c9a494b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @theguyswithaball/color-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79cc7aaca0ae641de0049aeeee6f8615e1d0ba68d46cacd16f64f6474e588128 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in royal-rusd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00d358c8908eb9219ba78f7c8f5bfa4dab3f305abae74588cd127937d428a9b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in electfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64eeeaaaecee6600ca86699f4c659542db61ebfface1833d80eba4f4c6262eb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tgnotify-bite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0489631fbfb86dd3d40d89b15c0b9de41c61473d6629fd189e00e506ca76071 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in decoder-params-sha256 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7de5b5773782024f4e6b21196d61a56837619e8a27d030795be59a1e8ef29aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uniswa-v2-sdk-holesky (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b3a7c9e4a1aeb30f596a4588e56a926e18474530347066d8b4a1c8c7e4975f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in soid-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 798d67475843002360c8b5a57278413861c9f65c9aed461fdd0f0c06827126b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cosmjs-types-sovid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff03b9e9190c6a1b2d6e0a1a45fdf2d283b229c27d05d93e5aa22d2a2787ff4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ganach (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44d0e0ea9072d2a215a3d5a2ca5685bcbbaf8531c4e760fe4fd270cfda7ef381 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in buffer-code-exercise-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68 The gem declares ext/mkrfconf.rb as a native extension via the gemspec extensions: entry, which causes RubyGems to execute the script during gem...

Malicious code in cheesebox (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76 The gem declares mkrfconf.rb as a native extension in its gemspec, causing it to execute automatically during gem install. On execution the script...

Malicious code in solidty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b231de91fa7d074ddcf64e499308714efbd81c16607a57bd8e1e53b809287267 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stelar-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a300192bd68269ea0056210f0b0fa2960e33680247f68c836c96bea194e862a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...