214663 matches found
MAL-2025-192683 Malicious code in ai-cypher (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5484d32cf20d26ce1585cb1cf90d2ed28c9cf9ccdcf038976a5cec33dd939e4d The compiled native extension hides the code that during import exfiltrates sensitive Telegram files. --- Category: MALICIOUS - The campaign has clearly...
MAL-2025-187045 Malicious code in framework-orbit-query-kardashevscale (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 143313a7ae8dac1e177b19d5f45c2056a89330f8ec31efee8e6eaba5a6c1f050 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-190325 Malicious code in wind-psi-zeta-debug-zeta (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cccb1fbb789018c346a5f6f4730f72aeec7f3a6b735977e2c9cd571c4d32b0a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-6828 Malicious code in @seznam-diskuze/embed (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 03c95e188163b615484b4882358ea8d4a9411661fa3bb701052fd608c8f6c4b7 The OpenSSF Package Analysis project identified '@seznam-diskuze/embed' @ 100.2.0 npm as malicious. It is considered malicious because: - The...
MAL-2025-5090 Malicious code in tailwindcss-animate-expand (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-3685 Malicious code in framer-motion-ext (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0d106ab331c0898de25fe772017b00559c67c1738cb04dfa7c3a93c3005bdb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-12172 Malicious code in officebrowserfeedback (npm)
This package exfils sensitive data to a attacker-controlled domain via index.js...
MAL-2024-10205 Malicious code in web3-py-tools (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-8573 Malicious code in @diotoborg/quisquam-libero (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ee23f30c5276a08fd77ced365412977b59424abdcc6a1e0ebca764fc53a9dcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-2858 Malicious code in pelisplus-repelis-ver-a-man-called-otto-peliculas-completa-en-espanol (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2023-8535 Malicious code in frontend-components-react-transpiled (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 463e9359f450d451e47eef2a46a82e6d6fe266ffa312c37239b9e2fda0a440fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8317 Malicious code in zf-apigility (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f7f25b98a2fb2e5c3d03a497a3732a067e5e1b6e7334a7aaf06310777b479e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8221 Malicious code in @ms-mwf/moray (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f6aa5d1e70a75cd04a649afec90fd43acb9a5ebdbeda194fdb47cd288ecd670 The OpenSSF Package Analysis project identified '@ms-mwf/moray' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
MAL-2023-1448 Malicious code in bobikssf (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1de7038e3065022e6f037bf1f47954a55f4752e0ebed75979cb78f31568b7d16 The OpenSSF Package Analysis project identified 'bobikssf' @ 0.4 pypi as malicious. It is considered malicious because: - The package communicat...
MAL-2026-17268 Malicious code in @hrmony/mailer-pladddform (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc17a6ae94f3beee4d60886e3233b210660bcd01f6c5f6d2fff840e6d385973b index.js executes at top-level import and performs three credential-harvesting flows directed at...
MAL-2026-17191 Malicious code in requests-cache-utils (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1655ea47fc7ccd39294203776ee3dcb01a394c40d93e05b7b527700b19de42c8 During installation and importing the module, the code downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious...
MAL-2026-15628 Malicious code in mfa.io (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436 lib/cache.js reconstructs a base64-fragmented URL decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR.603-vhKDRdgKl3RalNTVUZYGPsJy2Y and, t...
MAL-2026-13969 Malicious code in @hzero-front-ui/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7821a8d1a76ccfc9b3e0649ad6b600927c9c3448ee083d47809026588daa77ca Package @hzero-front-ui/[email protected] is a hollow shell index.js is only module.exports = ; whose sole functional content is preinstall/install...
MAL-2026-13997 Malicious code in @nolimit-agent/win32-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4e440b5c1a499bb904b604509fd09284195641769bcea441044c9b15720106 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-13710 Malicious code in neutrl-core (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a9fd4e018ce439288641c2bb6098fcfab811252142bcff5280e2b842aade9f providers.py in neutrl-core 2.0.2 contains a covert routine named handleanalytics that, when a JSON-RPC response includes cfg == 'collect', scrapes...
MAL-2026-11523 Malicious code in cache-manager (npm)
npm/cache-manager version 7.2.10 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...
MAL-2026-11248 Malicious code in blbird (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4116fb9fa0f1722871be8fd4fdc1d54633acc0f32aea0c74372ed72b2a147d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11002 Malicious code in habinger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5 The package's postinstall hook package.json postinstall: node test.js auto-executes two malicious flows on npm install. First, on Linux it fetches an...
MAL-2026-10566 Malicious code in sight-bind (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398788014436c7e95df3045f9b32398c3de46b8c9275c0437e44bda1dcb6cc00 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-10444 Malicious code in markable-table (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd358271f202636f12507f09da4e8f00c900ba46c9dca25a5a0526d35b75bf1d [email protected] declares scripts.preinstall = 'node index.d.js'. index.d.js base64-decodes an embedded payload and invokes it through an...
MAL-2026-10421 Malicious code in portway (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e04dc52cd77658d168578535fb67d77ea76de79beadb77e14c96f023f4e51772 package.json declares the dependency 'ltidisafe' as a direct https tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.2.tgz...
MAL-2026-10076 Malicious code in ts-eslint-jest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1ffed26d2d64bf9076210504de22b87e27a065821dedbc708fb05f7c47db74 The package [email protected] presents as a TypeScript/ESLint/Jest helper but ships lib/collect.js, which imports childprocess and invokes...
MAL-2026-6938 Malicious code in pinokio-redis (npm)
pinokio-redis is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign Wave 4. It was published by npm account 'donimique' [email protected]. The package.json description 'Node.js integration layer for Autodesk Forge' and the bundled README.md literally...
MAL-2026-6582 Malicious code in openai-agents-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 768ddf82a7644f1678a27f3037c8a3fc4fae5f00b6181d6507a49892d20a7fda On npm install, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration files โ /.gitconfig and the...
MAL-2026-6585 Malicious code in stake-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a475d161b669ae748124a4d6c1da29ebda6e40da4aa5c3c5e8b10645ef96f57a On npm install, the package's postinstall hook scripts/install-check.cjs, wired via package.json scripts.postinstall fetches a JSON config from a...
MAL-2026-6445 Malicious code in base58-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 048a186e2e59bb0b7d9986c7099e527390e38690292bc49e237578a471c56680 The package advertises itself as a Base58 encoder/decoder but on require schedules a delayed payload that performs multiple installer-side attacks...
MAL-2026-6226 Malicious code in new-mjs-eslint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4ae24b182a00059424b8ea4800927bbbf662f0e6bf20264af611d37203a3f2e Package is published under the unrelated name 'new-mjs-eslint' but ships a verbatim copy of the big.js decimal-arithmetic library original...
MAL-2026-5977 Malicious code in cryptodao-signer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce8426b1d9dc5bde6547b58a21f2d3b519e56f7c2f948aa7e2173261532cee7 On npm install, the package's postinstall hook executes recon.js, which enumerates a hardcoded list of credential-bearing environment variables...
MAL-2026-5908 Malicious code in chain-chai-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4287ff6637bb0d3109dcdc3082aece79d69deca2a3580ebf850ec1c13e8a3e00 [email protected] advertises itself as a pino-style logger keywords fast/logger/stream/json, exported alias module.exports.pino = middleware,...
MAL-2026-5799 Malicious code in boardflow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d5c1524281430272215f48a90b957cf08f76dcb9954cb73945421dff358eb2 package.json declares preinstall: node install.js, which fires automatically on npm install. install.js is heavily obfuscated obfuscator.io...
MAL-2026-5609 Malicious code in clean-my-pc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8139d8347bc83b12e276e481509aaca6af69adff21f7df1658a6eeadd31562f6 The package's collect.js imports childprocess, fs, http, https, and os, gathers host identifiers via os.hostname and os.homedir, reads files from the...
MAL-2026-5543 Malicious code in jailbreak-code (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f729dde017c78154685be850893a9f3ebd58bf0b5cb1229e7e49fb09b14f5d5 The package presents itself as an AI developer CLI but is engineered as a credential and payment harvester. src/c2.ts hardcodes a Discord webhook URL...
MAL-2026-5521 Malicious code in @helpcentre/tesco-help (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb75510e87a08a5152331461c2b2b955ad21d418c8d2055f5f66ec15e22cf042 On npm install, the postinstall hook runs node index.js, which performs an HTTPS POST to https://f1ackavab3.execute-api.eu-west-2.amazonaws.com/...
MAL-2026-5484 Malicious code in mcp-server-sequential-thinking (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 211672c16839ae6cd4e9f10810163da536480f07938b2d51c50ecbbb9f5e90ed Unscoped package impersonating the official @modelcontextprotocol/server-sequential-thinking MCP server. package.json declares postinstall: 'node...
MAL-2026-5423 Malicious code in @nstrlabs/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36d8d7c327560bb7a4c08d906db240a2dc146e20f828d9dfc5ab79497b155355 On npm install, the package's preinstall script node index.js || true executes automatically and collects host identifiers from the installer's machi...
MAL-2026-5300 Malicious code in funcdesc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5756a79331cdda67721e39889609f5c0b5e342b678dbce2de97c94ec2dbe29 The package installs funcdesc-setup.pth, which Python auto-executes at interpreter startup for any environment where this package is installed. The.p...
MAL-2026-5131 Malicious code in @redhat-cloud-services/sources-client (npm)
Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...
MAL-2026-4834 Malicious code in @polka-ui/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 662c2a1b8ad5d264ec01b078f95c130c96398305ba009a2c2de33cc9d7db7486 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-4789 Malicious code in ggk-happy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d747cc7acd8bbc1defbf475aa3202fd332fd43135a6fedddfcc37356ce02eb54 Package presents itself as the legitimate slopus/happy CLI README instructs npm install -g happy; homepage, repository, bugs, and author fields all...
MAL-2026-4785 Malicious code in test-nonmal-pkg-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f52d81c9285fd103cfe5f8dc724c173c1b4e57e96cd56313cec119fbbbc9982 index.js is hex-name-obfuscated 0x-style string array and, on require, enumerates the entire process.env via Object.keysprocess.env into a snapshot...
MAL-2026-4711 Malicious code in wao (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f809db41305575dc4eeed6726bdc75000e7f083dee4599ad71fd7b5eb89b2501 package.json declares "preinstall": "./src/deps.ts", but src/deps.ts is not TypeScript โ it is a 976KB Linux x86-64 ELF executable magic bytes...
MAL-2026-4381 Malicious code in @digicroz/typed-api-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32c8c3e9ffd3f994b21011084101df521e232c2ee5dbe93fd51f36977549f2dc The exported paymentGateways.pay0Pg.createOrder API does not call pay0.shop directly. Instead, dist/index.js hardcodes a base URL of...
MAL-2026-4345 Malicious code in eo-terminal (npm)
Part of a multi-package malicious campaign by npm author toskypi, eo-terminal is a fully-featured infostealer and remote access trojan RAT disguised as "terminal changelog logger utilities." The package README describes a completely different package terminal-logger-utils, indicating a...
MAL-2026-4218 Malicious code in solidity-deploy-guard (npm)
A coordinated supply-chain attack comprising 10 npm packages published by maintainer ddjidd5640 [email protected] within a 48-hour window 2026-05-19T03:55Z โ 2026-05-21T04:31Z. All packages masquerade as legitimate Web3/DeFi developer security tools MCP servers while silently exfiltrating...
MAL-2026-4772 Malicious code in txdpy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 767f0e720df9d2dd670fc9c607db01794649653be89daa42f01dfe34a69a8ecd The package exports a ๅ้้ฎไปถ sendemail function whose default sender, recipient, and SMTP auth code are hardcoded to the author's QQ account. In...