Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06d8987a5408de1fd879005877185e31a5a0931162318ade2fc1a4e6ce6592c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc69b9998deea152d8088db89469ab4f8fa468d68e8cb923b25c7e91f8facf04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @s4yhiitestpoc/scan-echo-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56326de32baad0d0d893359e14cf73b56e8139d714f3106fde0c24fdb4004091 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @s4yhiitestpoc/r2-control (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2818910f030224e598ac988354614e0febeaed195238b06fcefb80d1932dc965 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @s4yhiitestpoc/scan-dns-c (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb3c4b0863ee69937b926b58ee5255e26d0ab3737abd640b92956aef1ca03fb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dictmerge-lite (PyPI)

dictmerge-lite 1.0.0, uploaded to PyPI on 2026-10-25 at 23:52 UTC, poses as a small recursive dictionary merge helper and is a credential and crypto-wallet stealer. Importing the package runs the payload: dictmergelite/init.py imports telemetry and starts telemetry.runasync, a non-daemon thread s...

Malicious code in @k.vict1999/pino-std-serializers (npm)

@k.vict1999/pino-std-serializers ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The package presents...

Malicious code in wisewwasd (npm)

wisewwasd is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to t...

Malicious code in ichigokurosaki-baileys (npm)

ichigokurosaki-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in solidity-cat (npm)

solidity-cat ships index.js, which is byte-identical to the hardhat-hold payload: an obfuscator.io-style loader built on execSync and axios that fetches and runs a second stage. It is a new name for the hardhat-hold MAL-2026-14246 campaign; the file hashes below match that record's evidence. The...

Malicious code in solidity-gas-watcher (npm)

solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below matc...

Malicious code in wiasdcxc (npm)

wiasdcxc is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to th...

Malicious code in wiselllx (npm)

wiselllx is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to th...

Malicious code in ruby-baileys (npm)

ruby-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in src/Socket/index.js sends the WhatsApp w:mex FOLLOW query for channel invite codes...

Malicious code in aemeath-baileys (npm)

aemeath-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js, lib/autofollow-newsletters.js sends the WhatsApp w:mex FOLLOW query...

Malicious code in cs-core-api-phoenix (npm)

cs-core-api-phoenix 5.1.0 is a dependency-confusion package: its postinstall script reads the OS user name and hostname and POSTs them to https://nathanaccacio.com/collect on every install. It targets an internal-looking name and collects data from whoever installs it, without consent...

Malicious code in @bellaxchan/eleventech (npm)

@bellaxchan/eleventech is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @bellaxchan/sixtech (npm)

@bellaxchan/sixtech is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @lekzox/baileys (npm)

@lekzox/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Signal/Group/Protocols.js, lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query...

Malicious code in @monze1239/baileys (npm)

@monze1239/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @wanzforme/bails (npm)

@wanzforme/bails is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in birch-css-utils (npm)

birch-css-utils ships index.mjs, byte-identical to the noelc-css-blender payload, and an obfuscated build-cache.mjs that reassembles and execs encoded chunks. It is a new name for the noelc-css-blender MAL-2026-18249 campaign; the file hashes below match that record's evidence. The package presen...

Malicious code in kevinx-baileys (npm)

kevinx-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in loader-utils-kit (npm)

loader-utils-kit ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The package presents itself as an...

Malicious code in lunaaa-baileys (npm)

lunaaa-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/messages-recv.js, lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query an...

Malicious code in ndraawzz-baileys (npm)

ndraawzz-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in wxwxtt (npm)

wxwxtt is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to the...

Malicious code in @denzz221/baileys (npm)

@denzz221/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @raffnotdev/baileys (npm)

@raffnotdev/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @sakataa/baileys (npm)

@sakataa/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @zaxius/baileys (npm)

@zaxius/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs , using th...

Malicious code in @zyrennofficiall/baileys (npm)

@zyrennofficiall/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. A timer started when the socket connects, in lib/Socket/newsletter.js, sends the WhatsApp w:mex FOLLOW query for the...

Malicious code in @alannxds/baileys (npm)

@alannxds/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in canta-baileys (npm)

canta-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query and then MUTE, so the channel go...

Malicious code in @axo_cuy/baileyss (npm)

@axocuy/baileyss is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @bellaxchan/techxatz (npm)

@bellaxchan/techxatz is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs store...

Malicious code in pino-std (npm)

pino-std ships lib/contract.js, byte-identical to the pino-testkit payload: a copy of the pino logger with an extra obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The...

Malicious code in xzvbailss (npm)

xzvbailss is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in @dyllxnn/baileys (npm)

@dyllxnn/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in solidity-map (npm)

solidity-map ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below match that...

Malicious code in testtestkjkldfnjdfn (npm)

testtestkjkldfnjdfn ships nebula.js, byte-identical to the nebulajs-api payload, and a preinstall.cjs that is a single opaque Function... call decoding XOR-encrypted code at install time. It is a new name for the nebulajs-api MAL-2026-17220 campaign; the file hashes below match that record's...

Malicious code in @bellaxchan/bailtech (npm)

@bellaxchan/bailtech is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

Malicious code in claudeopuseni (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d On import, claudeopuseni/init.py invokes boot.check, which issues an HTTPS GET to https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json,...

Malicious code in claudeopusenifile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 051daf7dfb8c28210996afbf561646b38781f563483e6c2e7471add0a6021885 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds...

Malicious code in claudeopusfile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de2f0d45d8a2c0489d082d86a91c63fc5cad53f891b3dd1e976cd7479344c65f setup.py imports claudeopusfile.compat.ensurecompat during pip install. compat.py constructs the string 'exec' from a chr-code tuple...

Malicious code in nebulallm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5428d0f2f07674817697574b1993211dfa902bad746d8cd6efc1ad6b1fbbfd90 nebulallm 1.4.3 presents itself as an AI API client stub but ships a custom install command class in setup.py that executes on pip install. The insta...

Malicious code in zagents-message-bus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 177a91975e11b9b3afbc5089dfc7e4c4fdae1cb05f8307f397956c675533f0d8 pypi package zagents-message-bus is published at an implausibly inflated version 99.99.100 under an internal-sounding name, consistent with a...

Malicious code in @capsense/ccx-welcome-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060 The package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks preinstall, install, postinstall to run...

Malicious code in @capsense/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8 @capsense/[email protected] is published to the public npm registry under a scoped name at an implausibly high version, a shape used to override an...

Malicious code in event-bus-lite-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721 The package ships a binding.gyp whose target has type "none" and no C/C++ source files; its only purpose is a GYP !... command-expansion that runs no...