MAL-2024-7969 Malicious code in legacy-swc-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e695d88baed2f53db3da619c1ea2230342d8f853e21cfba4ba15019326e6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-23230 Malicious code in injectapp-org-injection-of-apps-and-news900 (npm)

The package injectapp-org-injection-of-apps-and-news900 was found to contain malicious code...

MAL-2023-462 Malicious code in fsevents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acdc3ae57250fab51aeff6e3938ed40197a1b74eb688a72cd5d7eee0c77a7167 This advisory is intended to inform the npm ecosystem with details to resolve a third-party malware incident that may have impacted your infrastructure i...

MAL-2022-4933 Malicious code in npm-cli-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb10e3aadb85207426e2f19a15effbe518d2292152d572f7bdd6e0f3fd24b0e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-21003 Malicious code in fs (npm)

The package fs was found to contain malicious code...

MAL-2025-6022 Malicious code in eslint-config-prettier (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2023-8346 Malicious code in situs-slot-gacor-pragmatic-play-dijamin-menang-tahun-2023 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cd7a331fb814fa537c53d27be98d58490ef24e73e0720abf83775b181ba3501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10319 Malicious code in appdynamics-libagent-napi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3ccb8490c24108245e9e5e4893518e881e48f0dafa4b0ad152ab458de4e7b1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-276 Malicious code in @flameshot-org/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfc208be31b8f932d6175ac98e7ddc5249c25d6e735a9af5a2c8266770cb9a45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1539 Malicious code in angl-archtslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e5d9cbbc6608e412a429d0d62fb5d10c38aa9be4ceb86df876f1f1aaafeb52ec The OpenSSF Package Analysis project identified 'angl-archtslint' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2026-11735 Malicious code in @or-sdk/users (npm)

npm/@or-sdk/users is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

MAL-2024-11033 Malicious code in dogwiftools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 072830cdf24f92d02ea5bb6ca4b9c474b7fa3a234ddfb1b98eaaccbc8cc06842 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14070 Malicious code in @ai-vertical/ai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3daa0f3fabdeebe3db0146233d623d65ae16aea601e54fd6519a160db5af8ee On require/import, index.js fetches a hardcoded GitHub Gist gist.github.com/aiverticalsolutions/7676451d2f972137d2482c4a8937a77a via the api.github.c...

MAL-2026-11970 Malicious code in file-entry-cache (npm)

npm/file-entry-cache version 11.1.6 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-11971 Malicious code in flat-cache (npm)

npm/flat-cache version 6.1.24 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

MAL-2024-2063 Malicious code in dashboard (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

MAL-2022-5590 Malicious code in rapidjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d8cde70e5ebdf9f1f3ca47531c69bd833ee151e87b26e71cab845eba16fdbe4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5617 Malicious code in sysnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eac9873e59ffdf79c56fd4f9366b56e0532f87dc00c4380fae18d714785b0bc8 On require / CLI invocation, sysnu performs two install-time-equivalent actions on Windows hosts. First, if python is not on PATH, index.js lines 42-...

MAL-2026-15524 Malicious code in tabbables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb package.json at line 11 declares a dependency whose key equals the package's own name tabbables and whose value is the raw HTTPS URL...

MAL-2025-48945 Malicious code in terrastruct-d2-bin-win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bec005a1e4b23bc2e97201bde7e77e009276fac62af29f61c4c657a081d3f10 The package terrastruct-d2-bin-win32-x64 was found to contain malicious code...

MAL-2024-12174 Malicious code in xeno.dll (npm)

This package uses obfuscation to hide that its downloading a malicious binary from an attacker-controlled domain --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8903fab539c0352f278ee3116807f48f52403f7e26b855fe9d68c3328012200d Any computer that has this package...

MAL-2024-7752 Malicious code in jfrog-ci-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ca6b5be5ca78626dbb231ce098412b200202572a0c8a3513b2a666e342d8004 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-2853 Malicious code in react-hook-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ae372e5061ef357237d48a7812ca65bbc3a49b8a57153df5812d17e9d8eeaa The package react-hook-form was found to contain malicious code. Source: ghsa-malware 5aa9ba7a4ea0b89453bdd073b8ffb80b6e3baab6684d5652a1e898c2bacb5a6...

MAL-2025-46977 Malicious code in is-arrayish (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb234972f25697d7cb6b5fee49c919d030c6f82ca0fa9068cc69f3bed952d540 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2026-14153 Malicious code in typescrit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adcb90c6a48b3b20928967d1aea32cde54035ed455c474a6db4fab148b424b53 On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a hidden URL that resolves to an unrelated personal GitHub account...

MAL-2026-13811 Malicious code in hcfguyfrmblp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f806fc6db71a1b888ba1f86d790b7a2866b4911e7f77ade2d375237e8c0a6ea2 The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page mimics a Cloudflare...

MAL-2025-192349 Malicious code in qt-main (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bd1f92a69928dc8fa2a6a50cfd596c34802bc68fc28dd5dd8508fc24344bbec9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-2731 Malicious code in ethers-provider2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64291b6905fba089a2dada5e0215c20954bf12f15f76d27c5c341d2b91baa81b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-4544 Malicious code in MetаMаsk.Blazor (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-14114 Malicious code in userbotjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0afcc62f361549813f605462124928c14c5228ba1d87e19adea38cc5e13c3609 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6361 Malicious code in exceljs-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 542e79c60c18aa779332620c884952b318f885c798a0ac8c2d3bf87bfad26950 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13790 Malicious code in bvdfhdfvnk3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fadba2f2b2bb1c3507b2559209c50677db3b20feb0c083333567dfe7fcbddc4 The tarball contains a single index.html declared as the package main, with no JavaScript entrypoint and no preinstall/install/postinstall/prepare...

MAL-2022-2913 Malicious code in example-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67077359006aa50f08c2757c83cc757f06c0b0817b3beb029ce4f6e823236c03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2047 Malicious code in com.outsystems.plugins.fileviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68e48c3e2dce6b01b3a80e3284dea055908e7c232a4f9fa11407fd851f4c0ecc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10758 Malicious code in mfq-private-encoder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2c0f78a3c5677481645e05e125f32273435610a1208a17ca4f852cb7f56b0e The package advertises a Python source-code encoder but has no local codec. The encodefile function and public encode API read the user-supplied Pyth...

MAL-2026-11524 Malicious code in keyv (npm)

npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

MAL-2022-6974 Malicious code in vscode-clangd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3e05ac1fabef54ef34176e9d555cb6e63b3dfbc2241cf304ab6a1b8b3cd2cc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10528 Malicious code in @vitets/vite-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf Package is published as @vitets/vite-ts and copies the legitimate Vite project's author Evan You, README, homepage vitejs.dev, and repository...

MAL-2026-5737 Malicious code in postcss-minify-selector-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f5cbb74f4dd4b4770e8c9cc1a8aac88a4450cb01dbc0fa5242c42e343f54c The package name impersonates the widely-used postcss-selector-parser library which it also declares as a dependency and re-exports verbatim from...

MAL-2026-5315 Malicious code in ensmallen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a05cd4ff9f8142405c5672f1ffa54d575165f6bc2b0f5324c9bfacf75e651de8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2022-6354 Malicious code in superset-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71368c8e29fe057fcc95335932ec6248b0a21541c5be1c4f54aa8fa03167a152 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6210 Malicious code in @apexcraft/nano-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c46938b3634fb4de89ddf44b765e1c766c871a40fb31c54609c1b3526074e65c @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator README and repository metadata are copied from yiwen-ai/xid-ts, an unrelated...

MAL-2026-10726 Malicious code in astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c This tarball is published as [email protected] but does not match the legitimate withastro/astro project which is on the v5.x line and depends on picocolor...

MAL-2026-10452 Malicious code in markdown-editable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b15669732f3eaec42e12c5f8d41a8f74d595fc04f709804de9768cb1719a94 The package's package.json declares a preinstall hook node index.d.js that runs automatically on npm install. The script in index.d.js base64-decodes...

MAL-2026-6760 Malicious code in @adobesign/as-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6752e4d30c584cb5ca6f67265c983257c1531aa306b47ec00b43ddae83fe2532 The package's package.json declares a postinstall lifecycle hook that pipes the output of whoami through curl to a hardcoded Burp Collaborator...

MAL-2026-5209 Malicious code in @vapi-ai/server-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67e1edd9922bb8b3962aad95b2bb1bfa39c3ec47651fe4863035111fc292dcfe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5478 Malicious code in mcp-server-git (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cf54d60f4aeb261f3b4c523293183b728b02bc20255aeab62d7f86c94adc7ed package.json declares postinstall: node index.js. On every npm install, index.js lines 14-29 reads os.hostname, process.cwd, os.platform, the npm...

MAL-2023-1011 Malicious code in docusaurus-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 051d35253b6ae2ef5d7366a3879b1783f91c35cc5fa1346198db3d6326e0e589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6309 Malicious code in @nullzero/urlcat (npm)

@nullzero/urlcat version 1.4.2, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern [email protected], with...

MAL-2026-217 Malicious code in experimental-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 946fb0e9d7a8c7da433d27ef4005111b34c3e75f8827686d43696855315d5867 The package experimental-utils was found to contain malicious code. Source: ghsa-malware...