MAL-2022-4691 Malicious code in monorepo-symlink-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85ce41560ca4bda849205f0e30456947dd54daec43938385934ce240e45546a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1693 Malicious code in -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-index-main (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3009 Malicious code in shazam-fury-of-the-gods-2023-full-online-free-on-streaming-at-index-main (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-7969 Malicious code in legacy-swc-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e695d88baed2f53db3da619c1ea2230342d8f853e21cfba4ba15019326e6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-23230 Malicious code in injectapp-org-injection-of-apps-and-news900 (npm)

The package injectapp-org-injection-of-apps-and-news900 was found to contain malicious code...

MAL-2025-36856 Malicious code in thunder-iris-jur448-project (npm)

The package thunder-iris-jur448-project was found to contain malicious code...

MAL-2023-462 Malicious code in fsevents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acdc3ae57250fab51aeff6e3938ed40197a1b74eb688a72cd5d7eee0c77a7167 This advisory is intended to inform the npm ecosystem with details to resolve a third-party malware incident that may have impacted your infrastructure i...

MAL-2024-9182 Malicious code in script-updated-roblox-redwood-prison-reworked-script-c5bqbv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b78659fb6218288f54c62b3f447a830fb0280c0b956bf43c74841db5510e7955 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4933 Malicious code in npm-cli-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb10e3aadb85207426e2f19a15effbe518d2292152d572f7bdd6e0f3fd24b0e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-21003 Malicious code in fs (npm)

The package fs was found to contain malicious code...

MAL-2024-11458 Malicious code in solara.dll (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-10225 Malicious code in mobileye-8-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e7b3a006f16102113625364a266a513016fe138d66a4008fc548e6df97c1a9a8 The OpenSSF Package Analysis project identified 'mobileye-8-connect' @ 7.7.8 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6022 Malicious code in eslint-config-prettier (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2023-8346 Malicious code in situs-slot-gacor-pragmatic-play-dijamin-menang-tahun-2023 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cd7a331fb814fa537c53d27be98d58490ef24e73e0720abf83775b181ba3501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2945 Malicious code in extraneous-dev-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e08815dacf458e78940833dd89e08a808779aabda6f12833e3ca42e28a3d0cdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10319 Malicious code in appdynamics-libagent-napi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3ccb8490c24108245e9e5e4893518e881e48f0dafa4b0ad152ab458de4e7b1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1539 Malicious code in angl-archtslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e5d9cbbc6608e412a429d0d62fb5d10c38aa9be4ceb86df876f1f1aaafeb52ec The OpenSSF Package Analysis project identified 'angl-archtslint' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2022-276 Malicious code in @flameshot-org/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfc208be31b8f932d6175ac98e7ddc5249c25d6e735a9af5a2c8266770cb9a45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7286 Malicious code in xnxx-dl-wa-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ae97fc6d17d4a931da57669f1fc5dcd02644f5a8c9c0f8d9a416f741c15368a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2944 Malicious code in extraneous-detected (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c37443660cc0f4d7112c362734a5370d76c45d1444f9ae76efbac3b4bbed71e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11735 Malicious code in @or-sdk/users (npm)

npm/@or-sdk/users is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

MAL-2025-191843 Malicious code in python3-6 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d48e27507362baa15b8e41d1554bce82077fcc870112ab6cb4d17694b47c8ef3 During installation, the obfuscated code is run and connect with a remote server. In the current version, the code just opens a URL without exfiltrating any...

MAL-2025-22760 Malicious code in http (npm)

The package http was found to contain malicious code...

MAL-2024-11033 Malicious code in dogwiftools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 072830cdf24f92d02ea5bb6ca4b9c474b7fa3a234ddfb1b98eaaccbc8cc06842 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-873 Malicious code in adsscriptloaderstatic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b68c5c565d5e74ccb2314d025daaf561be580a1b406cd797cd5d8f02d13c3c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11970 Malicious code in file-entry-cache (npm)

npm/file-entry-cache version 11.1.6 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-14070 Malicious code in @ai-vertical/ai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3daa0f3fabdeebe3db0146233d623d65ae16aea601e54fd6519a160db5af8ee On require/import, index.js fetches a hardcoded GitHub Gist gist.github.com/aiverticalsolutions/7676451d2f972137d2482c4a8937a77a via the api.github.c...

MAL-2026-11971 Malicious code in flat-cache (npm)

npm/flat-cache version 6.1.24 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

MAL-2024-2063 Malicious code in dashboard (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

MAL-2022-5590 Malicious code in rapidjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d8cde70e5ebdf9f1f3ca47531c69bd833ee151e87b26e71cab845eba16fdbe4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5617 Malicious code in sysnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eac9873e59ffdf79c56fd4f9366b56e0532f87dc00c4380fae18d714785b0bc8 On require / CLI invocation, sysnu performs two install-time-equivalent actions on Windows hosts. First, if python is not on PATH, index.js lines 42-...

MAL-2026-15524 Malicious code in tabbables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb package.json at line 11 declares a dependency whose key equals the package's own name tabbables and whose value is the raw HTTPS URL...

MAL-2024-1139 Malicious code in boukiapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e9af3c6aabc1d88faf00494cf4894995cd20b96fb4b40a1d4bf32c98f3fd782 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11897 Malicious code in yir-image-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6cf1af517e2c58b4cae223cb5d746eed91636fca7b9843a427577a641e12a0f7 The OpenSSF Package Analysis project identified 'yir-image-gen' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-12174 Malicious code in xeno.dll (npm)

This package uses obfuscation to hide that its downloading a malicious binary from an attacker-controlled domain --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8903fab539c0352f278ee3116807f48f52403f7e26b855fe9d68c3328012200d Any computer that has this package...

MAL-2025-48945 Malicious code in terrastruct-d2-bin-win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bec005a1e4b23bc2e97201bde7e77e009276fac62af29f61c4c657a081d3f10 The package terrastruct-d2-bin-win32-x64 was found to contain malicious code...

MAL-2024-7752 Malicious code in jfrog-ci-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ca6b5be5ca78626dbb231ce098412b200202572a0c8a3513b2a666e342d8004 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-4553 Malicious code in Monero (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-2853 Malicious code in react-hook-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ae372e5061ef357237d48a7812ca65bbc3a49b8a57153df5812d17e9d8eeaa The package react-hook-form was found to contain malicious code. Source: ghsa-malware 5aa9ba7a4ea0b89453bdd073b8ffb80b6e3baab6684d5652a1e898c2bacb5a6...

MAL-2025-46977 Malicious code in is-arrayish (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb234972f25697d7cb6b5fee49c919d030c6f82ca0fa9068cc69f3bed952d540 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-28475 Malicious code in Orchestrator (npm)

The package Orchestrator was found to contain malicious code...

MAL-2026-14153 Malicious code in typescrit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adcb90c6a48b3b20928967d1aea32cde54035ed455c474a6db4fab148b424b53 On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a hidden URL that resolves to an unrelated personal GitHub account...

MAL-2026-11561 Malicious code in @cacheable/utils (npm)

npm/@cacheable/utils version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2025-3615 Malicious code in beautifulsoup4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48b598862c9e9e3771899aef5867eeef964cb09467b70154f6e5824d27b683f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-3435 Malicious code in @squawk/airport-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a12035131eafd29a07572751653f857706ac1b113fcbd498a70f54d96d5276cc The package @squawk/airport-data was found to contain malicious code. Source: ghsa-malware...

MAL-2026-11558 Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-13811 Malicious code in hcfguyfrmblp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f806fc6db71a1b888ba1f86d790b7a2866b4911e7f77ade2d375237e8c0a6ea2 The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page mimics a Cloudflare...

MAL-2025-2731 Malicious code in ethers-provider2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64291b6905fba089a2dada5e0215c20954bf12f15f76d27c5c341d2b91baa81b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-192349 Malicious code in qt-main (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bd1f92a69928dc8fa2a6a50cfd596c34802bc68fc28dd5dd8508fc24344bbec9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2022-275 Malicious code in @flameshot/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8bbca4a9cd0a35a35928860188f38aa877f6edfa6b4eb2b65c110d2d83990bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...