Malicious code in @bestcoolman/dev-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af28ace408ef7f1cb36a4486816b589867dd20b65c437525c3dbbada455c2213 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in charape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 642f1d05c7f56e4648be237af99c1dc703e0dd7d829cb398379f01de3e2f3385 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in file-saver-bg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb2c5b4b6b375b1e32fa020b91c41061e43028b84baded3d7ac0aa49fe67d2f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-bootstrap-table2-toolkit-bg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cef5fac5058c556bc407491c506977e99b2bab4d2128b6bdd51d03169cbe89a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-bootstrap-table-next-bg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a11f8ac581f8b8cc2ff1bec698360084c46b97d1dd5ef86e927bdf048d4d9f44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in archetype-index-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1b1555b791fb92917363f7284951d05b5aa93965418c780c39a2d86c9ec9e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in template-pictogram (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3841b6d06a61a6dca4677771af04f3a1611aecea70dda90a4672bb4b6f1fc109 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in template-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a92510a22366de728e3ff108fed3d501566c544d1e74eaf4fa04c608f43bd601 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in template-projection-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39336416a695a52c21d74f7d971565610ee17c230d6af786821e4f69a240ff04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @aaron205whitmore/postcss-animate-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95ac232603d6c2830256e0516b8a95f7c91ea3c6956ba96c94e93c9cbce700f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dsh-ungate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a660f4353216e548bc40977463bcd181435354a0aed48c8c6f5166f684061176 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in focashi (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @liauto/linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc2348727fbdb337194a094294a2c936fc0274881d00015bdb50b619679f3ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liauto/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c20a6b6a0f08f9561870f63d63c387446ec038c65bce43e72ca5b520d435dd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liauto/darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bb2b50f4a9436e787b102dc986889cf4d1f8bcb0c3ceab07fe627504c7f399a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liauto/linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0afa7cad70973dc7b004e044909f1da93caffb0c0761cf874732910aaadd5b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yonzofficial (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @dikaaofficial/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73c4c3c76a097b59a06458db858d32b6db531ff93e0eb31ef5963b74925979a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @dikaaofficial/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d13cad8b4e2767a06b70fea52ba8fdbbdf72bf83fd14513483f086552e058da7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @chatbridgeworld/baileys (npm)

Malicious package. @chatbridgeworld/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. on connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channe...

Malicious code in gpa-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3331d71b6fa180fe472df60d66c4404db52bce9fc6459f006e3a9abcc4e4746f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @velliajs/telegram (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6882a1c6bafe9cac501f27c10853bf4f182eb2804e728f5b52dfec6c66e206 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zhg.sql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6c08abe2baa8de1ecc01a9eee7dae4156c741418e0ee6faf86f0028ce33f3ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in winks.tunnelsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a49d8202c6bdb59ef8cf9a7deda1afe3b60e77e8bfd0ae68c9fc66d3b86bceda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gqb333/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff4c69d93c28dd7793261e62e83e0e034a2ff3ca88b508cdaab6e9cb3704c23a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @gqb333/based (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78585219ede86ea7ddb7afe471589a604f9ab109ec3d7c328a2ae7bb9709393a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @massnerder/x402-scraper-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3c2359d61951f070234818950891a0ad6daca0a77d897b33992d5dba40d5b119 The OpenSSF Package Analysis project identified '@massnerder/x402-scraper-mcp' @ 1.0.0 npm as malicious. It is considered malicious because: - T...

Malicious code in @hello.nrfcloud.com/proto-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2289a77ed3d168f29e1ae25e13f4385431cabda6fc82ba99a089fc9fa4a5f9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in logger-libs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55 In this new incarnation of the campaign, the payload is spread between multiple files and reconstructed in runtime. It then downloads and executes malicious co...

Malicious code in u-chan-secrets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 619be2223fd3495f02e8056622d411dab9e8dc8d08891620734f7a6a8b9fb568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in seolibs-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2eae635c895afc3a8f13c2f224c50f85d2bbaef0cd1165b6d8ffaa018e74923 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ethersphere/bee-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e40e7247019419a32a3f25176f5df039894ce096f8105dfc4a7b40383034d49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in extrahtml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f004357dd044b3c2c644a1f759dcd47a154a37533635280af0f3b5adb76469a4 In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file...

Malicious code in parseyaml (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3 In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file...

Malicious code in bundyfed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de During installation, the package downloads a malicious executable holding an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent,...

Malicious code in lookuptest11 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in super-color (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 908af2bf828b75158c5bf0aae5a9d422694f21f566a745ff42b82f1f7ed4560d Package hides a code downloading and installing an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in supercolor-tui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9798fa32337256d29d4b551193b6aa6817601034ce787bae4d09d7d6636d813b Package hides a code downloading and installing an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in control-character-command-injection (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75 The gem declares an extension script in metadata.yaml that RubyGems executes during gem install. At install time the script reads host identifiers...

Malicious code in agentic-call-control (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5 The gem's native extension script executes during gem install and harvests installer-side data without consent. It collects host identifiers current...

Malicious code in dynamic-object-handler (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b The gem declares mkrfconf.rb as a native extension in metadata.yaml, causing it to execute automatically during gem install. The script collects the...

Malicious code in donjon-ledger (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247 The gemspec declares ext/mkrfconf.rb as a native extension, causing it to execute automatically during gem install. The script ships no C/C++/Rust...

Malicious code in blender-headless (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edaff2bd9abfea10a907cf99f87b444eee0c7ff54e88face42fe7c000d64775 The sdist setup.py and the gcplogpoc/init.py module both construct a DNS label of the form install|import-random-id.blender-headless-platform.node as...

Malicious code in infra-libs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32 infra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the...

Malicious code in expect-tests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76 setup.py and gcplogpoc/init.py read the installer's hostname via platform.node and encode it into a subdomain of testa213022.dssldrf.net, then invoke...

Malicious code in rainbowcolors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd The package advertises itself as an ANSI-color helper but on Windows the first call to any Color method print/paint/call downloads an opaque executab...

Malicious code in chromacli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faa55f651aa1c9e23d9cbff405b6ca52086c950c76e05e04b8dd49f74dd19959 The package presents itself as a terminal color library, but its exported API Color.paint / print / call contains an import-reachable Windows code pa...

Malicious code in @htooayelwinict/travis234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2063ecf38d2b7342633616dbfe9b2933f1e9d9ea73116105e55d6313279ac6e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twitch-stream-py (PyPI)

twitchstream/getchat.py is a modified copy of the sounddevice library. Its queryhostapis function, which other functions in the module call, decodes a base32-hidden URL, downloads a Python script from it to %USERPROFILE%.steam\script.py, adds a value named "WindowsUpdate" under...

Malicious code in pyuserox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9554cf718372c4b1b545c805969d454a5baa65b62274339b1a00fd80ce6e7a86 During import, package silently download and executes remote code. There is no other action. During analysis, the remote code was no longer accessible. The...