Malicious code in tchain-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94fd98c5775fb82b893b1e8c8a4b16cdf82232ed5974665eb7652400fd61ca99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in neat-terminal-visualizer-84721 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd2f2b0037508332127abb0c212f21d6bf504396099642d35e346eeb82ac6650 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in agent-trace-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3205c915b20c02b2ef68e41585a81f9bf045967458ad3c79e029a50e64b2b645 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in agui-session-recorder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0af51c6ce9e42d4b8dd8a58ea710d800bda5fe4fab26b094ee7e8470721d933 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mcp-contract-tester (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83dc469ccff23b0510c4ff543f8ad70606435d8bab288541fc505e3bf1f2439f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @solana-common/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7087ead98ce98127e76fb23dfc73b7d35f1695a279dd62161e792e590ae94571 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @unipswap/postcss-animate-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 379946e069d6c59c1ad55cc25f14f1726d64bfe9ac9ea2f78b8ac753d2411a15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-kinetix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5ffa04045b27093df6b2b6948036a54dc79dbb136ae7435777c2219b8ba201e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @web3-common/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12960bd3037e9081a447029a0fdc571f27fe4f59b1dda2d14a6707e85d880015 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fapshi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f06563ad63eeb93c78db058e72d73896742322209f013d14f701b6e38f8cfd39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @erlanzz/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in futrou (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 331465c8581a5dcaff2ec4ed0ace90f59daece320f7826bdfc40980aaf146331 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lwd_uri_util (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 912a23b9591c44a2e3f0e45acc7ec6a62051873048dbc8590ff331a11d205614 The crate's build.rs runs on every cargo build/check/test and under rust-analyzer and performs installer-side credential theft unrelated to the crate...

Malicious code in dowload_ebok_pickleball_cpr_coaching_pickleball_readiness_by_claudia_a_fontana_30268 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9309169c4319ae7a7983d5d1a848b06aad21811c1670b55cf703a6c828220180 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dowload_ebok_ulysse_by_james_joyce_2tbxz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6aee109fff9317f5ad330a5903e91279c6a88aaa6ea08601dd8f5e1c3cda9395 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dowload_ebok_la_historia_universal_en_100_preguntas_by_luis_e_inigo_fernandez_0w097 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34d9d1ce708caa6a8af7878cc54f0c266773e26bcfdef1eacfe0375146a547b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dowload_ebok_ho_mangiato_abbastanza_by_giorgio_serafini_prosperi_txkvg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f435c05ce67163043e8367d4c9f09a9dc0da29a16d617b7d80f20246f9abb41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dowload_ebok_frau_holle_die_nordische_gottin_hulle_und_ihr_gef_by_holger_karsten_schmid_1u2dk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71a5f70c03b3b7cafa8ff649f9d120d7b3c699ab37d091f001a79a6350c75e57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dowload_ebok_mein_fur_immer_by_b_h_bartsch_jjche (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 178e474b25dc6b679a9c49267d74937798829d31788d6fc4ebd0cff48f4cdb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dowload_ebok_la_ternura_de_dios_by_papa_francisco_kq4hn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01abac02eeaf77bd08861c6c7da985cdb9ce2b4fee707053d8d6fe2186313b43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kube-health-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6592a59b41b9928b9771b58469401c30fa595f763612cd12057317f1e325aee2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6241954ed6cdce254dd2e73f55c26de3e0e4d017d7356b8e39f236560855805e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in moltbook-api-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f89859f7a0e62f33caa2bd23565203feec21a29d0cea90e5dee90fc9f0fcc826 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in moltbook-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b546ed201568e078d865a16019aa35169bb5d41f8d73e32b7305f0d35c8eaca1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nodecheck-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5800db58ae1e62a8fb5256e896b43a8eb16ffe1c0e578cddab8ced25f3349dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in leveldb-edit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54266582f63ea6cce2dd300034c1025dc0eb81a2ffed523a98fdeb481729d746 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @openyard/vetcode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b52edf9b7cb501d1e1b2e8c336a029eebef238e51c881739d100adde9516d5b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bestcoolman/dev-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af28ace408ef7f1cb36a4486816b589867dd20b65c437525c3dbbada455c2213 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in charape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 642f1d05c7f56e4648be237af99c1dc703e0dd7d829cb398379f01de3e2f3385 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-bootstrap-table2-toolkit-bg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cef5fac5058c556bc407491c506977e99b2bab4d2128b6bdd51d03169cbe89a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-bootstrap-table-next-bg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a11f8ac581f8b8cc2ff1bec698360084c46b97d1dd5ef86e927bdf048d4d9f44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in file-saver-bg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb2c5b4b6b375b1e32fa020b91c41061e43028b84baded3d7ac0aa49fe67d2f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in archetype-index-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1b1555b791fb92917363f7284951d05b5aa93965418c780c39a2d86c9ec9e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in template-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a92510a22366de728e3ff108fed3d501566c544d1e74eaf4fa04c608f43bd601 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in template-pictogram (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3841b6d06a61a6dca4677771af04f3a1611aecea70dda90a4672bb4b6f1fc109 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in template-projection-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39336416a695a52c21d74f7d971565610ee17c230d6af786821e4f69a240ff04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @aaron205whitmore/postcss-animate-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95ac232603d6c2830256e0516b8a95f7c91ea3c6956ba96c94e93c9cbce700f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dsh-ungate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a660f4353216e548bc40977463bcd181435354a0aed48c8c6f5166f684061176 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in focashi (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @liauto/linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc2348727fbdb337194a094294a2c936fc0274881d00015bdb50b619679f3ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liauto/linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0afa7cad70973dc7b004e044909f1da93caffb0c0761cf874732910aaadd5b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liauto/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c20a6b6a0f08f9561870f63d63c387446ec038c65bce43e72ca5b520d435dd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liauto/darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bb2b50f4a9436e787b102dc986889cf4d1f8bcb0c3ceab07fe627504c7f399a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yonzofficial (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @dikaaofficial/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d13cad8b4e2767a06b70fea52ba8fdbbdf72bf83fd14513483f086552e058da7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @dikaaofficial/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73c4c3c76a097b59a06458db858d32b6db531ff93e0eb31ef5963b74925979a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @chatbridgeworld/baileys (npm)

Malicious package. @chatbridgeworld/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. on connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channe...

Malicious code in gpa-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3331d71b6fa180fe472df60d66c4404db52bce9fc6459f006e3a9abcc4e4746f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zhg.sql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6c08abe2baa8de1ecc01a9eee7dae4156c741418e0ee6faf86f0028ce33f3ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @velliajs/telegram (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc6882a1c6bafe9cac501f27c10853bf4f182eb2804e728f5b52dfec6c66e206 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...