Malicious code in @thone33/react-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61eb9ba2a2fa618c4672668424b22247ac6038454b7ea8e74ee518d4ef4d9635 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in edu-npm-helper-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ee91f9cf6f537f6f3e92c12fa56937dcaf79acaab105cd46740695d4ccd0260 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in edu-npm-helper-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c0d091940dd53e17c0559c69dadd3ed7bc12dfdf110b488e01fe235d8033024 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in txs-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98a8b0307879bf2bc46dff29fe69118808e91074267b971b97953defd9c4972f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in txs-runner-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23ca04e5d691c417599a28f83df508532ccce1c52a12e5908dd02760d24abdc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in txs-random-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2fbf9f715398c5e2041d0bca1412ae9a5eb94d025e289b02c3ad808ecdd9d9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in txs-sdk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d758c93423d2608a6b63ba594e784743e84c54061bfa1a647eb447fe86be01e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sixbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39404fc7b16b66b76bed0e8794563ad0a40a0f16dafd81fbe68f35e2c5bc9678 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vinnxcode/xbailsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9107de0deb8cfa91ef2bb3ca6de2af14aa715a3bb70fb110146a62e3185a1c94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vinnxcode/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6cd5c2aff996c3ecaed23aa0fb0f0b63c2fc829c2c1689b0bc27136714c8ff8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in amanexzyra-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91b75d849a9528c5b5c36142e8bed1b9b29063b91116e75ece79eff0f2c5a6cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @fazzcode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b23d843a30dd9b5c78048a16613d2640994dea02e0231d696d474fe0cd79c3d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fazzanime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 078273c8fb515986eb1019d1fbd9f00c675790be7144b7a68680374352f55881 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fazzgram (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a52666799631d9dafa5956873881477b3c1ccc08780cda261af89994db3d2ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sqlite-tag/schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c0c9a31c77b90dcf433595d03bef3c4752075f134be6b4568dccf2751bc63d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sqlite-tag/sql-creator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a88585293f864e712b64feb436171caab5fc4d9c5d9d3509b2a0a67e04b6e8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sqlite-frame/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fad23440ed1dfd9c57e3abc48d9ea51787f5788482dbcd70e852cadf5191986 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-self-destruct1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efe4bb7647313d9772c059e46a877ab095ada0910845e5605fbb317ab2b01fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @my_name_is_khn/express-security-tool-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb45d8539214aba2ca98223064b29e9fac2199f766f7e44430ba9f9b4d2d622d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in random-ua-generator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 543206058a0b8e85c8227a0bfdd4752fc61779b24968a0bd5d50ae6b3040387b During import, the code starts a keylogger and exfiltrates data from cryptowallets. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in @ks-radar/radar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 24bbd0f16f929682cd413abde1e40578db9fa5b2ad8cb7cdc9927c70f5f5f710 The OpenSSF Package Analysis project identified '@ks-radar/radar' @ 22.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in blessclient (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cce3c8791da7093bb0d6aaf8b79f49e5cbbcc4114f075f60121fc99b31c74e09 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in swiper_angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 474db4780bfc49ff2146966bdd508c123baf4d39c636e27aaba1996a0016d8f6 The OpenSSF Package Analysis project identified 'swiperangular' @ 5.9999.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in whs4_deu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 96d7709dc56eae4bfe07031da42425b4a94a169255cd7b3bde0f31f0516e0fb0 The OpenSSF Package Analysis project identified 'whs4deu' @ 1.0.1 npm as malicious. It is considered malicious because: - The package communicat...

Malicious code in wsh4_edu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e68d4c62ae8440581c4400e1cdacb7877912eb23610e273432d18cea61574785 The OpenSSF Package Analysis project identified 'wsh4edu' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicat...

Malicious code in whs4_eud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d906ecaf9f2ede0a31c6966b9d8402f4c80e57fb72eae7f9dfa1b3a7c583b8d4 The OpenSSF Package Analysis project identified 'whs4eud' @ 1.0.1 npm as malicious. It is considered malicious because: - The package communicat...

Malicious code in page-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c65bfe970c4520a6ac5c7e51efa638985191d6e01ee4cf3db97d270cff115d37 The OpenSSF Package Analysis project identified 'page-navigation' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in identityscimapiserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c77102d108de4236b5ff8d121143aaa19efde51a10e4f63a6f79ad2dc982c34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xo-member-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f87897415ac7cb1f40cf896ec879d2a71a642d3361935df0758944a34389b13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in f0-form-manipulator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b44787fd6b711e395dc87ae7f5235d0e80d5591a925f9149319aa7d6ba3f0f72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in preferenceslifecycle-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8741695d3ce21420a88f903f03c16da4621561d07117127b656f91488c9b58f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in merchantprefsservice-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cb0650e6084dbdffdf3011ee427b9997afa2ff2778d43e5e7929945cd14f54a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gpaas-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04c01a5b087d1c4d6ae8700fd1fee92cdb45c5a77f59a62723b17b5aa43e7f5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pp-react-ui5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f33e8ad4e8e4d1037b0532607e4ddc2a7b9738ce59388d7258dbcc285ac900d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in payoutsvettingserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32d630492188c1db46669f68ec67e108a452a185dceb46b7fd0cb3bc939e865b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fundraiserservicepp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cefb4588a67439c112176df4b9af71d40a1e2a12e0bf81ef200affa79e0cb0e0 The OpenSSF Package Analysis project identified 'fundraiserservicepp' @ 1.5.0 npm as malicious. It is considered malicious because: - The packag...

Malicious code in trongridy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a437be8ac21a8c375aeb02c4ab825bce027392f95aa356491950536454d2bf58 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in clerk-next-fix-auth-protection (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11ae257db932f3501d4f9168d9fb3c7abbdb1c6dad37f5bab183785662b3d9b6 The OpenSSF Package Analysis project identified 'clerk-next-fix-auth-protection' @ 8.8.8 npm as malicious. It is considered malicious because: -...

Malicious code in discordnv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646 The package exfiltrates Roblox cookies and Discord tokens from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in app-data-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b8c073af489e9e7102ec43ca525f91f88615b572d4d0b0e65c6b64b647f93ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in app-data-lts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f35120670504586b6090e4cac9dd795b88170e1da09a6f0ad6955b665a6cda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in app-node-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 175a4ca1d8f0f386347ce87b04012ff634cc3dee7b08117e72bcfa1562a213e4 The package's postinstall script test.js executes multiple installer-side attacks on npm install. It recursively walks the installation working...

Malicious code in mrmustard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535679eb30bfd0600dc07e44d2e649c88ecb6274364e2ba0b1ef2ccc05976727 On plain import mrmustard, the top-level init.py spawns a background thread that reads /.ssh/ private keys, /.aws/credentials, /.aws/config,...

Malicious code in intel-cicd-repo-infrastructure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

Malicious code in subapp-pkg-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9ec05191ebd2f02dcf912c49fc5d345c3b9201fb691a11a0142fec91cc6d42d4 The OpenSSF Package Analysis project identified 'subapp-pkg-util' @ 99.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in @daylightqc/date-fmt-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...

Malicious code in eth-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a547e155b232bc3164db9fc1f7de92bf70a5f1ad02e277a6c9b272d47f48e00d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in govapkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...