148 matches found
MAL-2026-17754 Malicious code in @library-wide/library-shell (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...
MAL-2026-17826 Malicious code in @revizahoshii/hoshino-media-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65fe484d1302a25cb129e7fb56ebbf059f4c9469a85abc10ac695e605e34dcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17851 Malicious code in yoodan-github-single-ver-pkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5ec21b694320e65a8b1f38838f14f00ed00b3b1e4f6a5d6aeef960f900d1d55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17835 Malicious code in @saazkira/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 716e747d34d02e4d4b2d34558753e65ce26a72e086b5c2388427d22eb2b0e969 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17824 Malicious code in @revizahoshii/hoshino-fake-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bda9c3c386df18faa88110fc1cb8aa61654547c70ea0b3e970735dd69f247f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17761 Malicious code in @coopeuch/components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 042f083be94ae23751c73b5a73c0f11e4e9ecafd9ee9f1caa8c05b367ac71de8 The package declares a postinstall script postinstall.js that runs automatically on npm install and collects a broad set of installer-side identifier...
MAL-2026-17762 Malicious code in @coopeuch/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope...
MAL-2026-17774 Malicious code in nitro-bundled-dep (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622 The npm package [email protected] presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname,...
MAL-2026-17794 Malicious code in seed-phrase-validator (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb8d12a066c24d672bf16efe57267c46c727592ee21beb0e2accb3bb6e4bfb3a The gem declares a native extension but ships no C/C++/Rust source. extconf.rb exists solely to execute at gem install time. It decodes a...
MAL-2026-17792 Malicious code in nft-metadata-resolver (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee87c382dfd443e81b4cf0e8dc66749f9a129bd4239f984859aaaf760e84c629 The gem ships a native-extension script at ext/nftmetadataresolver/extconf.rb that RubyGems auto-executes during gem install. The script carries a...
MAL-2026-17847 Malicious code in npp-ml (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool. --- Category: MALICIOUS - The...
MAL-2026-17818 Malicious code in @alipclutch/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a547c784c13d1a96d07b03039a8997721e06467bda6794a2a1cc14a2cb68ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17789 Malicious code in hd-wallet-generator (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6925082b6aa5db29d0569324b4485976add2368c78635d4be5c52270ee3771 The gem's declared native extension build script ext/hdwalletgenerator/extconf.rb executes a Base64-encoded payload via eval during gem install. The...
MAL-2026-17793 Malicious code in perp-funding-rates (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 123418539e0264e9d58c8b51976723aff3eceec10520c231d7bc847edd51d691 The gem's native-extension script ext/perpfundingrates/extconf.rb contains no real build logic: it declares createmakefile'bitcoinrpclitenative' but...
MAL-2026-17800 Malicious code in wallet-hd-derive (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install...
MAL-2026-17856 Malicious code in opencode2-linux-arm64-musl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29d77295b1fca10788c9203f4cddd81390c2257ed49c9f260838bf5c383bab8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17850 Malicious code in @chatest/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe80b7b76923a24948c1d095c3dc2474c0aac3574a3cf2046bf152c7dcde0aac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17846 Malicious code in @yudzxml/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96357918fec8e046fe049ec94c614ab988e412532ace70beeb64d737533c3a30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17821 Malicious code in @fazzcodestudio/fbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02d04f078ee45b434a2f48ebecea2fc18811a6830ab2e24baccea6e577baa0e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17817 Malicious code in nakkinpm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 331be4e62118311084ef5b928ef3bedc450c59ffb7433d02246886cf501727dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17766 Malicious code in @s4yhiitestpoc/scan-https-d (npm)
Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...
MAL-2026-17785 Malicious code in erc20-approve-audit (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43c1d294111db5834d006f064d33001b463860783ed8662a5f41a8e7354e4b8 The gem's native extension script, which runs automatically during gem install, base64-decodes a Ruby payload and launches it via a double-forked,...
MAL-2026-17799 Malicious code in wallet-balance-scanner (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1506ac4eca059796d3f029e96fcfcafc24ffc6ad0b454ae831c06edef4064055 The gem declares a native extension at ext/walletbalancescanner/extconf.rb but ships no C/C++/Rust sources; the extconf.rb is itself the payload rath...
MAL-2026-17802 Malicious code in xrp-ledger-utils (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a...
MAL-2026-17876 Malicious code in @xxxfnbs21/hello-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69ca1e29da88b95415d443f6911d2facdbabec1a0cd7b756594ffdf4336e1442 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17868 Malicious code in @kre64/hello-npm-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 654ab50c81e138ba0fcc4b3775bc84574656f528ae4de5770a6441e850fdf8c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17879 Malicious code in @flexmr/ui (npm)
@flexmr/[email protected] runs node beacon.js preinstall, node beacon.js install, and node beacon.js postinstall during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to 177.7.60.239:48080 and encode the hostname in a DNS query und...
MAL-2026-17857 Malicious code in opencode2-linux-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf9deaf78da8cb6d551cd438b47ce0b248159ff7ee5768fd54427262a271be93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17845 Malicious code in node-telegram-sockets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaa0928c7e6cf97f1059c7c8ec8ea2c1ffe53c127480bfe8f5081b489676d26d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17823 Malicious code in @modss/libsignal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78daaf334cc6740c70b214309f4bf742a863b8c3c421076490cdb84790dd9550 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17809 Malicious code in minecraftaccfinder (PyPI)
minecraftaccfinder was published to PyPI on 2026-10-12 in six versions within 23 minutes 0.1.2 at 01:05 UTC, 2.0.0, 0.3.0, 0.3.1, 0.4.0, 3.0.0 at 01:28 UTC with no description, author, README or project page. The package consists of one module, minecraftaccfinder/init.py about 87 KB, 88 functions...
MAL-2026-17772 Malicious code in liferay-workspace-scripts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...
MAL-2026-17759 Malicious code in @coopeuch/button (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee1a3bb0818d46a9c83659ed32f8ab209477970658d5f6f8241a12c96d137c98 The package's postinstall lifecycle script postinstall.js runs automatically on npm install and harvests installer host identifiers — hostname,...
MAL-2026-17801 Malicious code in web3-signer-kit (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe57c8011ef7048ef33ccdb828615b8efd9ab10799a2a730d12c2d854c2e0895 The gem's extconf.rb decodes a base64 literal and eval's it at gem install time inside a double-forked, session-detached child whose stdio is...
MAL-2026-17779 Malicious code in airdrop-eligibility-check (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb3461788cd7b809ba613c07b39b583fb968ce927ccfc15433673e2731ca68d8 The gem's extconf.rb, executed during gem install, decodes a base64 Ruby payload and eval's it inside a detached double-forked Process.setsid child...
MAL-2026-17796 Malicious code in staking-apr-fetcher (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405ab5b9651b8e8817ae91290042ec22673c5c99c1b58f45747e47cbb85aeacf The gem declares a native extension whose build script extconf.rb decodes a base64-embedded Ruby payload and executes it via eval during gem install...
MAL-2026-17787 Malicious code in evm-tx-decoder (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e478aa0270779720106fc6169e89fde089af352214fc720fbf8c284d51415f59 The gem's native-extension build script ext/extconf.rb decodes a base64-embedded Ruby payload and executes it via eval inside a double-forked, detach...
MAL-2026-17805 Malicious code in @dransay/api (npm)
@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/ namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name...
MAL-2026-17863 Malicious code in crelic-bqwheel-52f66a3f1d (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0ca34d571eaf519847a961f7da1f203d35f7a3c011f5fd4df3744f50a0615d2e Package attempts to collect environment variables from a specific environment, self-identified as BigQuery user-defined functions research. The final...
MAL-2026-17862 Malicious code in fontcase (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9e2c4992e5295f2b094f3c7c2b2e6c2dbc8d0d9ca6242d58318e6e1b83a4255c During import, the package downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...
MAL-2026-17860 Malicious code in opencode2-windows-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fe5351d5ca6ebd5f4af15467079d2d442bad22237d10e6d5cb06d0b11beb2a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17867 Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs node index.js || true on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to...
MAL-2026-17870 Malicious code in @mntv-analysis/ui-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 50.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
MAL-2026-17843 Malicious code in @xrelly-stack/bails (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50a8bf97baef2afe279a36ada416d0c235247d68c31748c360ca9bf863cdbe49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17827 Malicious code in @revizahoshii/hoshino-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54e78d94690ef4e2d415c7754cf5e87fa9585670df0485bfd467a58e71a8afa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17825 Malicious code in @revizahoshii/hoshino-mcp-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9672a5dc6f8c45d8f76743e019edc248d1ba5523560bbe6e2a8185bac64b668c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17829 Malicious code in @revizahoshii/hoshino-store-mysql (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0b408e63765025424d6570c3bd05bd6e01534734e6613fabee59696d11d1f15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17831 Malicious code in @revizahoshii/hoshino-store-redis (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 479c2ff94e78f7493a07e739eb36adc5eba6c31d7e2846a3ecea52d04dd3aa9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17842 Malicious code in @we3js/framework (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b363085b57cf1cfd50b00e3845bdd50122e4e2f137a124def03f5cf59e7b23b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17819 Malicious code in @badzz88/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eafa4b306df1ba72117512af8f1b676cd101c93bac67d887418f318b39efcc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...