Malicious code in basek (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f82b1f071f557e9f25cfce6d7643f19053c6a2bd7d61470fcf114ac53e950c63 basek 0.1.0 is a Windows keylogger shipped as a Rust library. The exposed getdata routine polls Windows key states for alphanumeric, function, and...

Malicious code in hesk (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83716a1c499cecbd64fe45f5ff56ab70ea6d1543e922c55e0514f2e2a69fe391 The crate ships two reachable async payloads — pub async fn dat in src/test.rs and pub async fn bs in src/parse.rs, both imported from src/lib.rs —...

Malicious code in acustoviasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1b7333093822a9bcb12475b4f9a7e57dacecb962f9157f2b67f53ab7797f085d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in @hesxo/forge-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b541721260dfef499396c5e7ddce0284e679fffa6abed53153d765318fd78710 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in otto-git-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5c8eadd28f7dcc587c399947b45b621d4b5def26e58adf156ecc0f736338718 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @hesxo/viro-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cca2ee52335e4cf061ed32c77fca91619828007bbde4527f9078af124ead3426 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in depfix-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8aa4880470ce564cd102baf4a4da6ad7923cb9c4cd50975e927a4a274bbcde67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ferrotts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b9cf8d8b5adcccc1d9d9b99d8148dee71751f256afb19962e88fa58cbc8ad71a This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in flowmetry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3cd9c2027e6d2cd6df943297bb9304a6190ad887bc70ae8477ee81697006b889 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in garviscope (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b9a85e3733b61731415cd2c00077af90475fd10d79833c025013a7f0b966ef15 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in evalometer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5311054d0bb8bc91f2121df374d526ca42459a664f15198eeeee4133cacf6941 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in wavforge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e017f6da32e0eec5f8bc75486e5bfb1b016bffea08ce26fb715e816de64ca7ea This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in phoneliasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0fb66d50cba21c857c53f0336e328c0d81eb1aba12a77b17e29f3e818302c1f7 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in garvisuite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aba6c4e4d80dd609e6858233c87d8491d40516add07e3bafc8b9aea5f6baa896 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in lumitts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c1093eeb37afa2ce37481f4c7bb25156eded3eaa1e847e63cb141620b8e41550 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in spectrova (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e8a78fd42fc449cadaae37c314b15fc82adf945a869f636718488b7e61baf7a9 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in voxgramasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ada38683f334fda70b705c68576f12fe0bce098e47837b983e8e92dc4e51e12c This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in voxrelitts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 519830c724d27578cd9be64f1063a461a1f12f3cf7eeca1a0bf3b01785aa7624 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in stackvane (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 45bfb9eab4765a149f6e3ac7c08c09236115073f1b2df8a9919a6f91ffd86600 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in melstagen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ac28e45b20df71fefbc8a6294c7e7a202f42b356e38dc49b0e28f335fb9a2737 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in inframetric (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1dfe7ee88510cfb327969ba6fe21e6dda575abbe6f2a8f7e2e4174c8a58384b This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in eulaliatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26264ebade1f8ffae1a24c93ad17e82008b388609927b61132f46bbca94159ff This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in @rclaude/darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a04c69fab6f8174cbdaf13a74bf088b576d39732febab52ff6c74afd2de9855a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @brunosps00/dev-workflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b262a2fb9df42da360022fd6a7767e75e2ad093cee27a157fe9b82060811d55f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in future-scripts (npm)

On October 10, 2026 local time, boom calls localStorage.setItem'key', i 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges calls boom before input validation; the bundled source map confirms this path. Version 0.0.3...

Malicious code in pentest-copilot (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e305059e2c1f7f8f37b8478aa90214d1e916fc3f2287eb90f7bca7e9dcac32 The gem declares an extension script mkrfconf.rb / RakeBuilder that runs automatically on gem install. At install time it collects installer-side...

Malicious code in @csp-frontend/dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48723231b0a1e6148357f5144b07fecccc2a68e442ad0bc5b03aaaa3136d1a6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @csp-frontend/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6d7b7c625fd2fb5d7d2ced04961b10ad3c90b45d515afbdaed838d3bc015767 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @budetzz/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d769dee6e977515610fc17a1d0e5cc02f0a723b452be80b4788ee4e0e0abf7b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @theguyswithaball/scrambler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b900ffb882f993399c4a8958c1f144751bf2d992a99f8fb6636817b6c9a494b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @theguyswithaball/color-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79cc7aaca0ae641de0049aeeee6f8615e1d0ba68d46cacd16f64f6474e588128 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in royal-rusd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00d358c8908eb9219ba78f7c8f5bfa4dab3f305abae74588cd127937d428a9b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in electfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64eeeaaaecee6600ca86699f4c659542db61ebfface1833d80eba4f4c6262eb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tgnotify-bite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0489631fbfb86dd3d40d89b15c0b9de41c61473d6629fd189e00e506ca76071 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in decoder-params-sha256 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7de5b5773782024f4e6b21196d61a56837619e8a27d030795be59a1e8ef29aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uniswa-v2-sdk-holesky (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b3a7c9e4a1aeb30f596a4588e56a926e18474530347066d8b4a1c8c7e4975f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in soid-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 798d67475843002360c8b5a57278413861c9f65c9aed461fdd0f0c06827126b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cosmjs-types-sovid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff03b9e9190c6a1b2d6e0a1a45fdf2d283b229c27d05d93e5aa22d2a2787ff4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ganach (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44d0e0ea9072d2a215a3d5a2ca5685bcbbaf8531c4e760fe4fd270cfda7ef381 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in buffer-code-exercise-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b575cb1f6c5f576af68398e3ad383942d6ec5f065456948bc51df018e7e0ab68 The gem declares ext/mkrfconf.rb as a native extension via the gemspec extensions: entry, which causes RubyGems to execute the script during gem...

Malicious code in cheesebox (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b03698e5384db9f041d0e2caa51db10abc0d0dcbfc1e5e77b795acc4d8cec76 The gem declares mkrfconf.rb as a native extension in its gemspec, causing it to execute automatically during gem install. On execution the script...

Malicious code in solidty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b231de91fa7d074ddcf64e499308714efbd81c16607a57bd8e1e53b809287267 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stelar-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a300192bd68269ea0056210f0b0fa2960e33680247f68c836c96bea194e862a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-lineclamp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f15c7e14c6ed90bc8f58e8060d64ab45bf5a2eb364610c34310ac86f0ce249d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @go-gost/mcp-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f00b5dc6f4d1c9058e8888e522818a3d425796b7109c0e20cb6bd551cee631f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @codentra/postcss-kinetix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c4b16422714de4b66762e02f3f8a65254e000995de8cdc0bfcb554e0728b739 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-motion-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d042b3f066b04cadb3e43edc8a3321fa99a70a0c83aa7a4c231c47c45acdf6b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in diezyxhao-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 302336139c0920b95210fd3fbd41521bae4c846d7e9b8baa1e7fe874bbc03f7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in diezy-libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware afdfadf34d9c6b821549c35ad5ca3f96f3386860c8b540dcda1fe10d49c985d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pdf-html5-page-flip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3ff36ac8518eded0b7acb87f26ae3d704ff2924722ac2415450afc1ae32a869 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...