Malicious code in @fyxzpediaa/libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3808ed94ac5c3235bf07f26f1159927b61f4ce208749cee231682be3c30130e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in msgpackrpc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9747a902bd61a745ec9c8f569f57417303f828b441c3e4e8c95101adf1498d13 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in @ai-ecoverse/slicc-windows-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff47f1460fce06cddef5a6a77557395053917a94e987ddbc0f8d5348dc2034cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in extera-plugin-runtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b13320bcb71932e051e8e2a8fbd98f3e8faadae85f0ae60ca2f1c2cf8d827829 The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically. --- Category: MALICIOUS - The...

Malicious code in screenshot-desktop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64a8bf18bfc6aa72293012942c4716b0fa4bdd134f4edd49d0b1c78cc966a5a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ifasn/ms-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d Package advertises itself as a Markdown toolkit MCP server TOC generation, word count, table formatting but its main/bin entry unconditionally invoke...

Malicious code in w002yardprobe (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 721580f8eda44ad5ee7604f5ba0648e8830302f784e3e4a995e02ca7359c909e The gem ships a .yardopts file containing --load./script.rb, which causes YARD to execute script.rb whenever documentation is generated for the gem...

Malicious code in brida-frida-hooks (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d The gem declares an extension script in its gemspec that executes during gem install. On install, the script collects installer identity and local...

Malicious code in yzx-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b51b209fe5d701ec9bab4cc9544162b4232acfc18c867f4a1cd09ce816b1d788 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mocha-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc4da3bdc21069601a8f0c9b06ab4b4f90930f54c1ed05c3162a2c52d27f543d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-form-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 982a885e35238eeb63f37a2d7e87eac99ff0eaad0514cd7f61778e5511694d01 The package's declared main entry src/index.js begins with evalatob'' that runs on every require/import. Decoding the string-array reveals...

Malicious code in react-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d186bd6a8ec4a6482a8e951bac94904fef98f09e8a8fff714dd4526ba93557 The package publishes as 'react-contact-forms' but its package.json author is '@tailwindcss' and its repository points at...

Malicious code in tailwind-input-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 630101a331666e0b23f3bf13fc5b6390d361ccc4be631c55f6ea29d10f3f7711 The package impersonates @tailwindcss/forms name 'tailwind-input-kit', author.name '@tailwindcss', repository pointing to...

Malicious code in jito-bundle-jito-tip7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbd7164079f3dedd0a6b686c00d7c6c5284307a75ed8183fca263a4e43b1cbb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jito-bundle-tip-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 565f7de269854ec0dd2c7e78b81e3dfb04a318dd760ecf4897b97731ee6c7822 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jito-bundle-jitotip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65f901538cb8c1e3c2bb9f8bb0fbcfda58c631a136a1419ea048c9cf9b3aa033 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jito-bundle-solana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92a82743c84b99beaf31ce188b36df4abb4b8045524655e9310152d9ba998821 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @touchkey0111/jito-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8783a215d13546b62ab39b9230f346367c912cf76218080d3d96c4d8b5db894 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arbkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae8f9dd5f329cccd4daa03d6fdc316b116291ae853ab3119cc3fa3f34f6b62b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ln9qw38745g (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e0a9c91e26a02abe14a9881a1c539a2f48d71aff120be6a4c286f36ee4cdd603 Package ships an embedded executable identified as malware by AV vendors, and is related to a previously discovered package that after a few releases swapt...

Malicious code in protecteda (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8fb01cc262b8645b045f6d9b6e0454ef525c928a48f8c0904cb63301f1be9e0f When started as a module, package runs an embedded executable identified as an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent...

Malicious code in txnforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45b831fcc35bdfb28fa17be14f502a494fab42eb58556e61fdcffba0cb3926e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in print-hello-world-test-temp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b4c55a93972ce0e01df9479a68e4387ec3d069b461e7da17d134f9466054859 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zyto (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 817f92245d406e764c42e8038b2ea559a6bd6deb1706b80e2699e0ab724111a2 The package ships an executable started during the building of a wheel/installation. It has been identified as malicious by some AV vendors, but primarily it i...

Malicious code in hijuko-pilara (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e03de70d14b6b6e3965178f06a73eecdd7197978d8363aaa7c83cf8f3d32696 The package uses fake http-downloaded dependencies to track downloads, and has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical...

Malicious code in filipt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a214411b19c9576191a2bde7b40d921418dc236bcfac35cab6e467d7c879667b filipt 0.1.5 bundles a 34MB unsigned Windows PE filipt/Helper.exe and arranges for it to run both at install time and on every subsequent Python...

Malicious code in ll3zea (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42e2617048f60278d06ad151fc3565b594d46e7ea635eafcdcd589fe3df51324 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gvmabc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1df7c2ae254405af50e1d4c7020503412a0deeb8ad95a118f0a3a16a948d7cab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ru0z83 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3f3f62bbaf55aac4b41abe3798072f84749702f09a420fe9d45901932503f04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sgj0kx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9ed7d5cb5c85f5f25e188a875df77157a955c48043cc22a98886fc471117518 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in t6unrv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c050f6a66df4876ddbe38ab187d157974f23f0d86b93f6f67aa66d1dcaa27910 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wolce9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d910d9b0e316cd8cf7855d6bf005d0bd4fab57b19cafdac2bb28a875e8990d7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in v36sl2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 828f646eae3aa3f8a1ba000ee615d477513488b52cb84269e1155661fedc646b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qxjf8r (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34dd4f29f16a87bc784ec4d421fff97bdc685ae2bef3ae54e9129df78bc2c8ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rtvu6h (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de5af0f7479d0799e12dc5a46d65d4075acadbdb6190ceed425ec627dbc0e27d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 5df897 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26b07d3652e7d7bb0d09973f7d32df8bded9be3e79347215f5100578242a3756 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bznio5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c5b28b27b4e8cefba6c836049ac039312132d0cd49edeb187db0b2254de2a67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wxmzfq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c117c2b4c66c59c6f11147192eadb193e3b356ae61beb056e8aede168a30aa8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wyrj3i (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e48db3f0780f31042a9515fe480bed063c11a612f81e846e1d7b9d7d8fd6480 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in y0syoh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bff2a3180fee838dbea6fc9558af68fbae4812d10885bc85787cebcd7aba904 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in j4pe0w (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fbcc75948876f24c259af2ff5f9eecac759f0a4e40a9f244fc2a1d7c6408735 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ib3rwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd99d43aa1978c7dfe043529db43a0bfa0a7aaa44e2b7939e2e16d2c3da5603b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 7un7kh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 730e238a0bc6cb2ffe83f080d6c43fc755c72b6a50e28a80affc2a4cc8c84ae8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in g3ypjg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97f16f85159ae2dc2e080ca716ee984675d616008132343bd2e55f0c85b42e44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jd7ijw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5a6a313510c35629048ca3193bad66b180a763bcf8f43f4bb4436592987da99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kojs0k (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce1c6a28be24166f3f441da8f9f754c22c4ba1b9d8018ab8dbc4a5b2f5ef86b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3zqth8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3679510311e99b4c7ecdbc28bbb7c583f1af927944ec516b96e3a2d01ac7b73c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 2tyegs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebbe8e85f98df5fcedb604204d70c6ea10b1be85fea065d42b7877a7b22b493a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in s775oe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1de14db91b08ddbfc5a25640fafbccf661a539e82cdde45890dbb74ab8a073c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in code-resour-ces-new-app-cloner-premium-9upyk2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19f71fb9f09898e3769eab133aa74fef5dc0435bf3199c0daac2ae87f26afca0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...