MAL-2026-4794 Malicious code in indextts-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc206ef48bfccaec8e81aac2b666e2d54a4a027e8432cc1d08d3823cf333caca setup.py executes git clone --depth 1 --branch dev-3.12 https://github.com/gabry-lab/index-tts during the buildpy / egginfo / sdist / bdistwheel...

MAL-2026-4715 Malicious code in weavedb-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 886f22636b5e4726978e23b10a4311fb7e65c2b10003da72429348fa617884d1 package.json declares "preinstall": "./vendor/setup", which runs a 976KB packed Linux x86 ELF binary sha256...

MAL-2026-4728 Malicious code in web-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edd19476eeb1c31707abe6fac6f52dbd1950a0dc25f4854ea5269d6400f8ea37 web-dotenv impersonates the widely-used dotenv package: its package.json copies dotenv's repository git://github.com/motdotla/dotenv.git and homepage...

MAL-2026-4323 Malicious code in nba-cdn-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6472220c5bb80d934ccb360b63359201b4f8e203bc8c173b27cd4181c15964b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4471 Malicious code in @zesyn/zeditor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c8e293ad2413e2e04b9ce3411d1650381143b104c40bbcb4a17c1140c9ef912 The package advertises itself as a browser rich-text editor, but on every new Zeditor... instantiation it waits 2 seconds and then POSTs end-user...

MAL-2026-4199 Malicious code in ts-logger-pack (npm)

ts-logger-pack is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that package when installed or imported. The terminal-logger-utils payload executes a postinstall hook that opens utils.cjs, an obfuscated malware dropper. The dropper downloads...

MAL-2026-3982 Malicious code in @antv/g6 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3426 Malicious code in mpkg123 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 df9e0498d827adeb16ea11e4a1137133d2124f039942b776f7ac098a257cd164 If executed as a module, the obfuscated code collects and exfiltrates sensitive data, including passwords saved in a browser. --- Category: MALICIOUS - The...

MAL-2026-3169 Malicious code in frank-newton3-db-final (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37a69c1c519dbe289ed217a75f1a31ace9b850acdb7df6cdadd95ca68f879f1d The package frank-newton3-db-final was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2965 Malicious code in build-metadata-logger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be01b550f3d8914aa6bd8659c9a410054e4e0bf9203d33e93478eb444e957b55 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2556 Malicious code in api-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c3bf88cef3ca699f69bada95749b40c4426c9a9c528e53c473698be88cbdc783 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2025-188376 Malicious code in nuxtjs-steganography-dynamo-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b011db95a7eefc14dc52ac07963321debbf596a0cb901153713ef86d2f4e28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-42383 Malicious code in @crabas0npm/totam-aliquid-voluptatibus (npm)

The package @crabas0npm/totam-aliquid-voluptatibus was found to contain malicious code...

MAL-2025-1003 Malicious code in w722-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74cbe1029791e4751e8b8c53fda75aa07cd3a6ca974a239c87867db522c2ee8e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-1144 Malicious code in google-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6e7f92b7d079e1dd3eac61bdcb4202ec2e5415b3925d6cf58b0a7bad0e20159f The OpenSSF Package Analysis project identified 'google-requests' @ 99.3.9 pypi as malicious. It is considered malicious because: - The package...

MAL-2024-1103 Malicious code in lyft-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d60f1a244bc4a4509672cc7a34d1db4ee83618066b02f41f15a6573ff6f5a2ff The OpenSSF Package Analysis project identified 'lyft-requests' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8508 Malicious code in zoo-web-components-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a033ba4e84e9b29f5eb20d41c448241b24f20fb48b6ad382babb24543441f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8506 Malicious code in ifl-primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cbddd298006615ef0975b9e718d03ba67c4cf761be2dc4048648ebd2866c0fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8468 Malicious code in vanillajs-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 19dd1596da1181577937a6d843a7fe1b41a9bb73029d7ecbd4c33e406ad73062 The OpenSSF Package Analysis project identified 'vanillajs-test' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8430 Malicious code in symphony-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b506566c2429e913410e95e32a4d3b3cf147e0ce887e4d04d743532c2476f48f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8418 Malicious code in demo-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7346c8d2670e05b376c36a799aafbe36cad56e319900ab63a766fea56e0985cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8373 Malicious code in @bitsoex/react-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e89332fc8c2abca1b7c5a14da73534cf2f08bbedb6a61665dd691b87893e008 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8345 Malicious code in situs-bocoran-rtp-live-bocoran-agen-judi-rtp-slot-hari-ini-terpercaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f73b571e4c0b58abd71ef8568110602a40db42e30e5a458b2e75c844a4763c0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8161 Malicious code in rambox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63e80eb984d70eca3cfadd2c9872df353dba45f0c14111f84c9c0ab34f8b8930 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8123 Malicious code in @apps-common/ui-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis efafe7e60f7bde7ddddd2cdd0c5464da613f467cef65d985b5984f75a323a349 The OpenSSF Package Analysis project identified '@apps-common/ui-theme' @ 10.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1489 Malicious code in marvelmaniac-devvit-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis db9d8f161a565dceb33bc07806d7e65aae706550b73220940a4ff28cf2a50d5f The OpenSSF Package Analysis project identified 'marvelmaniac-devvit-rce' @ 1.0.3 npm as malicious. It is considered malicious because: - The...

MAL-2023-10 Malicious code in security-util-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2309de1524c064d7eba8b0c288762426955241d23e00eaaeca7766758ab9054e The OpenSSF Package Analysis project identified 'security-util-py' @ 0.0.6 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8 Malicious code in kangpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11daf46221ff00d16c0c8784b95eba32196bb8f5543e2d3115c2b1826215c612 The OpenSSF Package Analysis project identified 'kangpy' @ 1.0 pypi as malicious. It is considered malicious because: - The package communicates...

MAL-2022-7048 Malicious code in wavoip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 978ec410c0a4c57a05e3ebf73205f1134733f68c3c56aa50bb7f295f3e5e8c16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3136 Malicious code in free-fire-hakc-donwload-tool-2022 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a796e6d443f661256e36c0ec90ea2993cc2d202c9ba8a1dd3459020fa65e4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16047 Malicious code in @usemosaik/template-react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...

MAL-2026-16024 Malicious code in blueai-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa623814be7289a45580d8333138d25b98458b558fbe67c447294944723ec844 package.json declares "preinstall": "bun run index.js", causing npm install to execute a 499KB obfuscator.io-style file via the Bun runtime. index.js...

MAL-2026-16003 Malicious code in trading-bot-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 653d164163afb590064deec1dc6619ed03e51360605a94e6ff789c83f6d9ec6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15884 Malicious code in guci-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c249413cd0bbe7f76321cbaeedac49d6ddbf63030ea67b514dd1a662e9fc8d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15844 Malicious code in onceaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52acfee73c36f7df40ac54204cef235483203b7dec9208d5b219cb7068d341f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15588 Malicious code in tronlinker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 18f3b8d2924d38ddd8e852a2ca3311ccb85a82a4a6eedc836c4b8086465dfaee Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2026-15496 Malicious code in amplitude-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110901fcd2d59ab6eed44d962da05830610e5c3cb03ca103db5a379e6c6052e4 package.json declares a single dependency whose key equals the package's own name amplitude-experiment and whose source is the bare HTTPS URL...

MAL-2026-14363 Malicious code in 2-loadsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5 The package consists of a minimal HTML wrapper index.html whose only behavior is to fetch content from a hardcoded, unpinned URL at...

MAL-2026-14301 Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

MAL-2026-14165 Malicious code in chalk-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbf1ccbcd9b3ae6643a7948154a981ef7e072afbae6d9611f832df11fccc6707 [email protected] typosquats the popular chalk package but ships no chalk functionality — index.js exports an empty object. Its only behavior is in...

MAL-2026-13833 Malicious code in prezdentkxheiw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b524c1b4d84ba3f109eddb254753a02dac72fa61397c4f03dbcbb814c6aaa68f The package contains only index.html declared as main and package.json. The HTML impersonates a Cloudflare 'Just a moment...' challenge and includes ...

MAL-2026-13796 Malicious code in cvbmxiowkwqla6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dbfcc7e82fc725383c9578e9d53c4e69bdf6af9ba8037d2bf9fa50dce51969e Package [email protected] contains only two files and no behaviors matching supply-chain attack patterns were identified. No lifecycle scripts,...

MAL-2026-13763 Malicious code in fetch-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5c49646ea7e22e74073aa7d8c9596d7d93100c429033383e975a2ab080de28 Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' repository, README, and author metadata all reference...

MAL-2026-12685 Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

MAL-2026-12669 Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...

MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

MAL-2026-10909 Malicious code in ibreak (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10669 Malicious code in dbconnectify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a41259fb0099de58bc669907fa6fb20331d794b13008df0afb42893808e4ab The package exposes a method queryDBConnect that base64-decodes a hardcoded URL HASHKEY → https://api.jsonbin.io/v3/b/6a609e63f5f4af5e29b05907,...

MAL-2026-10571 Malicious code in @wrenfield/viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ef631151a9f361646ced489dc5cc912a455332dee753090cdb89b94ba74f2f7 @wrenfield/viem republishes the viem codebase under an unrelated npm scope while keeping the upstream homepage https://viem.sh and repository wevm/vi...

MAL-2026-10558 Malicious code in akshajrawat.utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 105157af41712b64f8b36ec1cb01e28958e4ad828a0c08d0979a1f6e22d1f13d The package's package.json declares a postinstall lifecycle hook that runs automatically on npm install: node -e...