Malicious code in justinofficial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 811a0a085d06d96791acf3e5c87af1bf457f73f5418c19558d2bf8ad2be03363 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in levvleys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @levvicode/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in aytidaoffc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9cc1ad74f9e8877a0f1229523afc516f51736964eae8f159d0e48519da6895f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nachles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2da72f2b671a7523ffbe0a00550ce7ce7fe8db89c15ad07de0c8e964dd63d430 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @levvicode/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18cbd78c4ca4fa06eac43e210fa4544234ef696ea20b59737b71ce5833184c70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @maulenv/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4066bb598c01797163001810f75881d142c70779cfd6ef6b9bd838d7ce3c6e88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-animate-final (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7961570b88f7d462fa4b80912aacfa2cd239ecb3e00700d1431f2fcb7d8ceb26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-animatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d2a4349effecf9897d6d704e42ba50e80109de5b6533346bc8649e2f442c0700 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-animate-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d1257b54849808aed2580131f3b1fe66fe84e3ea269fa24d9f90aec9d813702 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwind-animate-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9525dcfcd1430ec58c7d819289a7136591139ba745b35dde7516d6fd650976b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in unjailed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bf8a2313291fe4963179c13770884f15804a098e9c156dd61d19563c730f3b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @mrlegendbot/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a49968dc4de126619a2eb1720e68b38768484995188eda6f8cc7bef6bbb32c95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bigdevin55/calculator-install-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4f509ad1b4b7cd4ab0ae5811238d85189643a2aae0157b75925ccd18f375e58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bigdevin55/calculator-install-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47b31798da27fd690ed90f5702bbe7458e3363fa5488b9d2c77ddd8e17da6111 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nuxzofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a17042e445631051160d83e41511f46995e3b5323b625a2a52aa260d12ccbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nuxzofficial (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0c5ef840e3b19a9367837e10bdad5698c89edd6a60e19f9cc0cefa5aa26fa04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @utilitycraft/tailwindcss-motion-atelier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c599649d975de035ad90c3e00aaa44e013bbac939a4c20e545b8c9669a7ea7ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcss-animate-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bca3980db08806736fa490afdb7dc84c9fde44f0363c0be8b21d299fa4f92f38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in atlassian-wallboard-plugin1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 807cc35cd4507bf2dae7c378dc81cdc04d0f49f47845907592ce92ed9633d2fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in persona-ai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32b7c1491521ddee48ecbbb75d77f9dabad642430d8d253f6ef5a256eeae57bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in intercom-react-native-example-e2e-tests (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57e084aff68cdd6201d55d3375bbc29f6e741553d4ac083f910fc38e110ef3d1 The gem declares ext/mkrfconf.rb as an extension script, so it runs automatically on gem install. The script collects host reconnaissance data...

Malicious code in shoaib-unity (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01fd98b807f4f85a6e016b143dec086ea16de731fb1de0cd84763dbf5d8f6919 The gem declares an extension script mkrfconf.rb that runs automatically during gem install. On execution, it collects installer host identifiers...

Malicious code in @goparrot-dashboard/menu (npm)

@goparrot-dashboard/menu is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @goparrot-dashboard/i18n (npm)

@goparrot-dashboard/i18n is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @goparrot-dashboard/marketing (npm)

@goparrot-dashboard/marketing is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/order (npm)

@goparrot-dashboard/order is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @goparrot-dashboard/promotion (npm)

@goparrot-dashboard/promotion is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/store (npm)

@goparrot-dashboard/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @goparrot-dashboard/franchise-management (npm)

@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard-api/shared (npm)

@goparrot-dashboard-api/shared is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard-api/store (npm)

@goparrot-dashboard-api/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Versi...

Malicious code in @goparrot-dashboard-api/role-v2 (npm)

@goparrot-dashboard-api/role-v2 is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/combos (npm)

@goparrot-dashboard/combos is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0....

Malicious code in @goparrot-dashboard-api/users (npm)

@goparrot-dashboard-api/users is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Versi...

Malicious code in @goparrot-dashboard/analytics (npm)

@goparrot-dashboard/analytics is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/auth (npm)

@goparrot-dashboard/auth is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...

Malicious code in @goparrot-dashboard/payment (npm)

@goparrot-dashboard/payment is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0...

Malicious code in @goparrot-dashboard/combo-group (npm)

@goparrot-dashboard/combo-group is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/franchise-directory (npm)

@goparrot-dashboard/franchise-directory is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/category (npm)

@goparrot-dashboard/category is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/settings (npm)

@goparrot-dashboard/settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard-api/orchestration (npm)

@goparrot-dashboard-api/orchestration is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same nam...

Malicious code in @goparrot-dashboard/franchise-marketing (npm)

@goparrot-dashboard/franchise-marketing is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...

Malicious code in @goparrot-dashboard/homepages (npm)

@goparrot-dashboard/homepages is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...

Malicious code in @goparrot-dashboard/loyalty (npm)

@goparrot-dashboard/loyalty is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0...

Malicious code in @goparrot-dashboard/franchise-menu-settings (npm)

@goparrot-dashboard/franchise-menu-settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same...

Malicious code in contracts-upgradeable (npm)

contracts-upgradeable takes the unscoped name of @openzeppelin/contracts-upgradeable and has no functional code. Its preinstall script runs node preinstall.js on npm install, which POSTs the machine's hostname, the OS username and the local time to the Discord webhook...

Malicious code in @an1mshnpmb9c84920/pipeprobe-obf-m19n5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66025f4cca9a4269af1b3b1278d850c9454b62d8e9ec90ad6e4ba8ac73c0fce2 The package's prepare lifecycle script executes node index.js, which reconstructs the hostname npmp19n5--768.oob.awss.dev by joining a string array a...

Malicious code in @axo_cuy/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b32f937714cfd8023a0123f7e15dbeb6a2146fd7f3a22f9cb5ff6728b9d3f48 package.json declares a hard dependency libsignal with the source github:tenka-san/libsignal-node. This is an off-registry dependency source: npm...