Malicious code in gene-rator-new-hearthstone-h-a-c-k-gen-erat-or-9wy4b5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40b0d77b0f2412148a16beecf8da3a7067de64e00de012ef6be48b30a50c61ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gene-rator-new-rope-hero-h-a-c-k-gen-erat-or-azkrvc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db74bcb32272ab097fafe505df6a6ef187b0fbd69fc195947c8ab57264676836 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in more-resour-ces-gen-daylio-h-a-c-k-gen-erat-or-qvi0r6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67327e7cb71b6abc01514870f219825033866f91931c61bfec3cc005159496f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in k7nhgj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77bf6e1b019cb178545a716c14fed8e8ab4b9b48c47d62b635a8010c2e9a7837 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in new-code-unlim-ited-jurassic-world-m-od-f-r-e-e-wuo1ky (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7e7ec28cf686f6014f7b67702baf64be3ef989a42dc045f3e50d1aebd77f7b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in real-gen-erator-one-shade-h-a-c-k-gen-erat-or-8ks294 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 137c4d0a14093ccb6d4218b82307921d2a211f26e6bf796ec24685f038746f39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in updated-gen-erator-producer-h-a-c-k-gen-erat-or-g8pi55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb31ba482b63d3a32742e5ac88c6486c3ec7b17ef80b78da43973ee753bae6e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in winjb6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66f25810500ddba52e0ffb1e34dbe95bf1d2bc99313c6c687740d0e7f6222f3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in more-resour-ces-gen-disney-mirrorverse-h-a-c-k-gen-erat-or-gulnxl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6f6e3c2a5b0836f7d565358a73433f0a8cb17dbc680293163d0040a46ca3220 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in working-today--empire-takeover-h-a-c-k-gen-erat-or-akcp8z (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19225370199f383b613251fb9731dd8a1aeac63c39124b08615fd23f1edcc536 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in new-code-unlim-ited-my-time-at-portia-h-a-c-k-gen-erat-or-i477p4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30605265c00e6f6a841b2503663b596b36a602d8427a2eff51986037b5e13574 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yhk9j0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73a85a2fc9eb8eeb9f593a52425f7325f24eb99d0e38d2affd06001adb42934f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in updated-gen-erator-rainbow-six-mobile-h-a-c-k-gen-erat-or-1179lh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4c69473553c19f8e552fb38c654c9697e18b91445b7af40d10df7c17ec179a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in updated-today-gen-photo-lab-pro-h-a-c-k-gen-erat-or-ofgpju (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b35965989a63112aef3b18fa2e5fe3feb7611d702801f12fcdf97dc1e2bea531 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in u0bh1f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bd6cb166750cea5323dcf9be0a09588b66eeab5aefd00e346fbd31dca67933b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in more-resour-ces-gen-tailed-demon-slayer-h-a-c-k-gen-erat-or-yas2jz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72abff290d1d1d848968aa9ec69f9ab99b95512a78b84a303e194d41082e7aaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in more-resour-ces-gen-stickman-legends-f-r-e-e-h-a-c-k-gen-erat-or-bv4n15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6c9bfc872f81ef96af9a773cface3ab6027c5a214314b8ceffc60fdb02b974c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in j5ugvu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b469cb41c59f1ca9f723c8d1b98906dce5826454e965ce9fea01c7dac24a2be3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 9ct8bi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a0a5df9aa29e8d7cbb51cc6a17adb64041391ffb803142e7aabe89a765541bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in l52upm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32a7eb3ab7be4abeb7282a01cd541d331a728a860b124c7a26cb514e750f2f0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in latest-update-my-talking-angela-h-a-c-k-gen-erat-or-q8z42f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ed023a56727f1d38d6718cd726bfdbb714c2f911d4cb7c100d824d40d057a70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 1b67v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 302d3a55e1eadf5101acb19d0cc1c8640555ce291662aa003c6abae28a654d94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in updated-today-gen-dr-parking-4-h-a-c-k-gen-erat-or-hmdcsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb61a390973626e6ae3d2cbf3f59cda284f6ed588d8abb3e4658c9b7ac77ceaa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in updated-gen-erator-carx-drift-racing-h-a-c-k-gen-erat-or-tkfm7v (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b671ab67efe2a884c351d5cf3d1b0fcc04baa40abf922eaafe9e6e37851a2637 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @shein-risk/si_verify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b1420471a8465c7d660991bf51bbb608d5770f30d57751bc1d0903c38dbaa00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vanzxy/baileys (npm)

@vanzxy/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own authenticated WhatsApp account to an author-chosen WhatsApp Channel. Part of the campaign OX Security documented as "PhantomSub" 2026-09-28:...

Malicious code in @vanzxy/nusa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8ac273ac60b02b6eda206ca3f20487af0ac8928e103ec87e5baea7be7727dec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @lynnidoffc/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 584ca35ead2d625e43abb6c62f640a80d53d817703f10758bd62d25343d72721 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @lynnidoffc/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fa15740e94892af7e682b675dcbdc75099cb54da6d17e4faf2a62806987ec12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nulio-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48c53c7d2ae821133ad337ff25bd5a7f399fbe2bc4f7aefbf1a1bf8dcb757d69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in blitzstrike (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69a410e6854eb560573a5be89cfa5ebc5f774e0fe9b51f40dc233aabc361dfc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dsh-moss-wallpaper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07c47b64630193ea404a2eac7a2f99277815514a62d2e2a1f4cb2e1d7f5a00e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vibes-plug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec1ad6fa26666e0fcbb7bb0cf7fbab7b44a1c9bb37906b11da264a0052b377e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dsh-moss-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef95aa7f77da1d41994c6fbd70f8f7d03d41fe59b7b099118a8281bfd93c87c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in luna-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c01b0a941a0a3f23bc5c66bbc9e6cd9f3fae9c6f367d05a99b1abec64175e85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paidwithtab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2c0f4cad13929fc2351f604d8c3cd012f3e9ba1515c97600e089b8a996bd491 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dopc-client (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ecbe68fef68472dcc1e9778859b71dcba31c06e8db799d75bb95c013f6ab1da On require 'dopc-client', lib/dopc-client.rb issues a plaintext HTTP GET to the hardcoded bare IP 38.242.235.206 at path /depconf/dopc-client/require...

Malicious code in @atedone/workspace-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 831ecc7c41217227ee159b85e4510e3d58c956be016bd7582e94fefb011565fe On require, the package's top-level state.initialize writes shell integration files into /.config/workspace-context init.zsh,.zshrc,...

Malicious code in scdn-jquery (npm)

Version 0.1.6 contains an obfuscated loader in libs/18.2.0.js. When a website serves this file as a browser script, the injected code decodes and loads hxxps://oomcsn.cc/assets/js/m.js. That remote script loads a beacon and inserts an invisible iframe pointing to...

Malicious code in @corexium/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3ba0508c4009825b9eb3d248094ccbf28b2a2b4dcec420d1aaa533c1594729 package.json aliases the import name 'libsignal' to the third-party npm package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest'...

Malicious code in pyprig (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 11f4beddcb42e2348d31d2ef0605d72198a28e796467c8afbac5c5c30d870315 Clone of a legitimate Pydantic package with the added downloading of a remote code. The remote code is delivered from the GitHub repository and unpacked as a n...

Malicious code in @ifasn/mmd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b58b8adeff2784f4fdeb4bf0e873e5797893619b3bc36c55de55b85efca1b7 On startup, bin/main probes cloud instance-metadata endpoints for AWS including the IMDSv2 token path, GCP, Azure, and Alibaba including the RAM...

Malicious code in @ifasn/md-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb The package is advertised as a markdown toolkit MCP server TOC generation, word count, table formatting but on require of its main module and on...

Malicious code in @ifasn/mmdd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2999c5d0dd2a35fe1dfb6bdc17da36aaed07d4f6fa7e10f9f395a4b39d1c7265 @ifasn/mmdd-doc-mcp advertises itself as a Markdown TOC/stats/table MCP server, but on startup bin entry / npm start its index.js performs an...

Malicious code in @ifasn/mdd-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8295dd6d1f932aa9f2b865822f1a6f213e00fc288b35cd4b7d8fa0f07a8641 On load, index.js queries the Alibaba Cloud ECS instance metadata service at 100.100.100.200, performs the IMDSv2-style PUT to obtain a metadata toke...

Malicious code in service-roles-registry (npm)

service-roles-registry runs code during npm install that reads the process environment, credential files or the machine's identity and contains a request to an external collection endpoint: - 99.0.2 published 2026-11-02 17:53 UTC: its preinstall script is node index.js, which npm runs during npm...

Malicious code in bfvkjmeikpwhqxc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc18af375249e950878cf3a95c2290bdee9ec1a2e188d0bba906acda390403e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in internal-renderers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 278909ae8921ad2d06b0c033a34470a00adb33d3853e3793c8d9c473a362ad1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pandafortunerush (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 019d3c32de84d0958b6b15bdf73d9ba7813e7bc9ded749be0e44320d81d28afe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in justinofficial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 811a0a085d06d96791acf3e5c87af1bf457f73f5418c19558d2bf8ad2be03363 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...