MAL-2023-8255 Malicious code in csm27878 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0055598a8a443f1bd67fa612291473dcb36ba6e1c9927df85775eea3d207de11 The OpenSSF Package Analysis project identified 'csm27878' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8254 Malicious code in csmqrcode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7be3c7341134e3f6e8c5e298589bbf69296fe3056e225eb82b91aa3d23f5898a The OpenSSF Package Analysis project identified 'csmqrcode' @ 11.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8233 Malicious code in fca-bot-asuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a11398483bdb1e63dc33177aba0b472a6fba5ea548f7e7bea526beb89f23551 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8160 Malicious code in bbc-iplayer-sounds-chatbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2d586de5a3bb31f4049fd207aa2c3ffc23d175a74c56bc0a75c52fd116f5291a The OpenSSF Package Analysis project identified 'bbc-iplayer-sounds-chatbot' @ 5.2.3 npm as malicious. It is considered malicious because: - The...

MAL-2023-8101 Malicious code in ppreact7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e2ad9ded90a270baf25a460421789f5a815f2956ef05fcf3e1b96cf1b2f35eb2 The OpenSSF Package Analysis project identified 'ppreact7' @ 7.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8064 Malicious code in @get-bridge/bridge-string-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e69ac01e87147a835e5ab4045ff640d7fa9d2eb636aeb12eef6e1fc1577d021f The OpenSSF Package Analysis project identified '@get-bridge/bridge-string-utils' @ 99.99.99 npm as malicious. It is considered malicious becaus...

MAL-2023-7987 Malicious code in master-oracle-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b5d683c33e479ccc6ca6bb739fae7fc1a6d64781f08d95866becdfdd08e26fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8047 Malicious code in fiji-core-foc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99868c266f6b13c22eb7e5923b9f580d02691973cfe8a1a4636f226a2f4ccaab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7920 Malicious code in yoga-repo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bfdba41ba7e979cb19d028f2a4caec895183aa268f5bf2a1b2e1ff086366a1d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7916 Malicious code in ez-retro-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6931a4e6135ad2a4f946c7218b4fcf31f1efc0c75f0d58f96e9a5fa793a0e144 The OpenSSF Package Analysis project identified 'ez-retro-server' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1573 Malicious code in website-frontend-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 04f43ddaad758a9041c06daacb15db027a4552836ee0f59caa0b4762c87acdc6 The OpenSSF Package Analysis project identified 'website-frontend-cms' @ 99.99.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1571 Malicious code in gapps-automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2fc1e430c7dfe87a465530b1e2067f640fda560b96555750466520fb727d8f19 The OpenSSF Package Analysis project identified 'gapps-automation' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1540 Malicious code in js2restutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d759ec94669349db98c7b1d0f6d4a5b916e9a2ae8b98efe8acaa421a3824d689 The OpenSSF Package Analysis project identified 'js2restutils' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1533 Malicious code in mapsapi-area (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a12b68cea467324465b98ad4c7ffcddb67cac55eec195215bce156b916abbda The OpenSSF Package Analysis project identified 'mapsapi-area' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1497 Malicious code in code-debug-codes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c78c334cc38295767013c4a8b7bd904fd09069e4b7f938183d8c247eefb27bec The OpenSSF Package Analysis project identified 'code-debug-codes' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1477 Malicious code in miro-api-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 787331785bd7ba05994172e4c86d95681d3e2e53caf8660a6832eed760fbfb68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1465 Malicious code in ynf-core-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 448630b3766e8205c4a13bc9ba0261d3683efc228644c118134e4262037c3219 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1437 Malicious code in eslint-plugin-ironfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ddb571e2a90d22e958b983fe2578c4dc66915310367953568399aa68773cc77a The OpenSSF Package Analysis project identified 'eslint-plugin-ironfish' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2023-1440 Malicious code in react-dropzone-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2617d06d7f7e79da19c8a24acc1e620c9a46dcf8b6a5087f482081c2badff0de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1075 Malicious code in email-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 203207e38fb9a162ab88820a819775ff32aaa219b52107e9f072ab31966399da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1092 Malicious code in @n9xcnr5test/n9xcnr5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 98235bbf40ea66c28973775cba8ead37bb4dc1d8999e5ebf02eb3157d4ba74be The OpenSSF Package Analysis project identified '@n9xcnr5test/n9xcnr5' @ 2001.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-8023 Malicious code in developer_backup_test529 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6f73644ba1b18278f2efd5eded48ae6a21c8477dc4c6e8120676bdb356438687 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-1118 Malicious code in aws-sdk-js-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e64c49f08b91cb456113ae44bbd8efc8280a1c79aa45ca1bd0f019c4af6ad873 The OpenSSF Package Analysis project identified 'aws-sdk-js-v3' @ 1.3.7 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1300 Malicious code in solodev-cms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1231265823e0166c738416defa7883c13c543b22ed1f2240daa1517f20908741 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-308 Malicious code in eone-gui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 918a850c8ec6b0b41a411a0def932e85ad9aba0a16d8fe866752386a2a59470b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-107 Malicious code in assets-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e513e7556846ca62fa4d27646eef928d55f2c2954ce9caa51dd63643e2adf445 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-488 Malicious code in gsattrack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2958f45d2f7addf081dc9f6e0719b1e36a54ba2a40ba3bd8ccc0763cb7deacb1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-2692 Malicious code in cxfreezepy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 98b9fe0f574ed33e0a4096ba8774936c73969493c1621244334a739ef4f94f5d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-602 Malicious code in mintel-react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0a1835239b54b7888436777e7e123e588fdbf2fe1ca95d9162e6803d5027515e Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-1360 Malicious code in crypto-pygame (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 12204aa041b42e90b2749e8026e866fbe3d5ff07e79899073fbc585b9950b727 The OpenSSF Package Analysis project identified 'crypto-pygame' @ 10.14.7 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1371 Malicious code in install-pytest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c354c0f5dc76b96d0db0745a885c308a97e8edfa82d219fda8c353dd567b43d6 The OpenSSF Package Analysis project identified 'install-pytest' @ 1.12.7 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8589 Malicious code in pywhool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 54738d1aef580f087fec1311b411aa6ddd2d7affb4b44353dd7f3d6a569a0ed9 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-1045 Malicious code in json2double (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 771b498cebd7036954c92bfa43feba6b8fd756aed6cb29bff183be0b196beaa7 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-75 Malicious code in a-love-letter-to-whiskey-by-kandi-steiner-on-iphone-new-version- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3543696adf399ee2a47ce791064b54f73b62253d59a299dd04ffd2cb1decae26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-478 Malicious code in god-a-human-history-by-reza-aslan-on-ipad-new-version- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ceaa90b6b9f360d75eeb0e21cc701c5ccc46fafebef1bdb9356bce898fbb1bfb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-651 Malicious code in oj-mithril-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5fee5d58e7e1464614f1aa017521ae6613da70897bbbc6ee11360593f419eca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1292 Malicious code in seafoam-desktop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11b7b515412cb320d382cffb4a3abe4fa232556d7db6ac3dde904bd295b279a3 The OpenSSF Package Analysis project identified 'seafoam-desktop' @ 10.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1182 Malicious code in fkletbbpoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 125b0aa54538899871c0071ae4b76678012092032ff03d6ad08c4ecf1a2fc7d7 The OpenSSF Package Analysis project identified 'fkletbbpoc' @ 0.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1142 Malicious code in commentrating (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 87db588ebd8e7a42cbbbbf7fc21caa36fc553172a0ff4c4e9a58ce9354d62e7f The OpenSSF Package Analysis project identified 'commentrating' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8009 Malicious code in ajaxmanager-custom (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cbfc18e18de3ecf81548e9fff07c310df0c09ae04271fbe4e2f3e6872af6c549 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-6777 Malicious code in selfvisapaypalmine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3a524c8256175ba1602631d62ca2c164baceef5887f1703949ab0176bb3b458d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5702 Malicious code in py-toolvmintel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2ccac77210f7a5f6eb7a2b5cde9438746cb1cb075e08e331a9fd47811447ce0c EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4331 Malicious code in libpongcvvm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 81660c08bc5b6d02626c861b078200dbc97f4f3eef60a500e32757b2c24a39fc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6233 Malicious code in selfintstringpong (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7ae3da8a16e34517abe55eadd3d1cc135e5474877de7bbe3d6d9873c23108496 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2875 Malicious code in esqgameloadrandom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 22513bf97736a201d391141f3507e7f37b18c109a7e0c5c37c9a285a21add19b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7476 Malicious code in tppyrandomed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7ae4f35f4b62a39c439b16d5a81eb24398dc404bb527e2543e524bfc543da367 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4388 Malicious code in libpullurlcandy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx edab3edc06b209aa1bbec0f7e1fc7ae8f0a03b9b53bbc5d74f1cbd1aec12bf8c EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7279 Malicious code in tpmineintgame (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 99f498d378f77740a149d3738085494eaefee3b0434d89468df4ee7ceaf0d034 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5678 Malicious code in py-studyvmpyw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 33426fde62ec7abad65c46ecec38eeb6ccf617f113b948e5853f00c77d7802ad EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6564 Malicious code in selfrandcraftreplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 94c94718b4b02f788325a9c38cbcbeecff0565e5f6237407774ffa05702717a1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...