MAL-2026-5529 Malicious code in v018-axios-cdntest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d30d2c9939173663f8ba1312b2591d2f86c67657bd5eeff59b19187f50b901 Package impersonates axios v0.18.0 index.js carries the genuine axios v0.18.0 | c 2018 by Matt Zabriskie header and sets window.axios=,...

MAL-2026-5511 Malicious code in nw-demo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0c784f9f2bc00678e2648cce9c110ad5084c595b42f80e086bc8dbfbe034359 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5481 Malicious code in mcp-server-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0b86cc4cf49b5d6cda37126f6a0c7c9f9fec648eb4d4743b6f39423613d3122 Package squats the unscoped name mcp-server-postgres impersonating the official scoped MCP postgres server. package.json declares "postinstall": "nod...

MAL-2026-5339 Malicious code in spl-token-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e05ba3043dc87365ee0b1dc44cc58243b34b6cdccdf258c5bb9218a06a65d336 On import spltokenpy, the package's init.py collects sensitive files from the installer's machine — /.config/solana/id.json Solana wallet key,...

MAL-2026-5289 Malicious code in unifi-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4c0cbc81f0d9b1df2dae7252888e87e046c36d049f2792dc7fc49d72ec1d9c6 Package is a self-described dependency-confusion proof-of-concept published unscoped on the public npm registry under a name presumed to match a...

MAL-2026-5288 Malicious code in uisp-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 351b32a85d024168970d1a2e8b7c9c5e6ff6f1d31191390f248a988d9ea6b9a9 package.json declares preinstall: node index.js || true, causing index.js to run automatically on npm install. index.js issues a DNS resolution and...

MAL-2026-5219 Malicious code in autotel-drizzle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed16d2715633927ef05b9b370a8d37f95581137f46144053bcb53f94430f2f33 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5182 Malicious code in brave-search-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7d65e78a73a4cc2064d0ab9210a76c7c55f69553b70879dd649d7ad84e48dc0 The OpenSSF Package Analysis project identified 'brave-search-mcp-server' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2026-5059 Malicious code in chai-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5110f40393583ef41ebcfa3558d782310a40a78227a040480d871c25311b79ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4965 Malicious code in @cloudplatform-single-spa/search (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

MAL-2026-4923 Malicious code in @cloudplatform-single-spa/iam (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

MAL-2026-4794 Malicious code in indextts-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc206ef48bfccaec8e81aac2b666e2d54a4a027e8432cc1d08d3823cf333caca setup.py executes git clone --depth 1 --branch dev-3.12 https://github.com/gabry-lab/index-tts during the buildpy / egginfo / sdist / bdistwheel...

MAL-2026-4715 Malicious code in weavedb-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 886f22636b5e4726978e23b10a4311fb7e65c2b10003da72429348fa617884d1 package.json declares "preinstall": "./vendor/setup", which runs a 976KB packed Linux x86 ELF binary sha256...

MAL-2026-4728 Malicious code in web-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edd19476eeb1c31707abe6fac6f52dbd1950a0dc25f4854ea5269d6400f8ea37 web-dotenv impersonates the widely-used dotenv package: its package.json copies dotenv's repository git://github.com/motdotla/dotenv.git and homepage...

MAL-2026-4753 Malicious code in gt-tester-exp-profiler-exp-00000017 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1490f970bd52c80c89f33029f9e875f1fb595014621d50e0ce87a167d1cd348 setup.py installs a site-wide.pth file gttesterexpprofilerexp00000017probe.pth into site-packages that imports the package's probe module and calls...

MAL-2026-4471 Malicious code in @zesyn/zeditor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c8e293ad2413e2e04b9ce3411d1650381143b104c40bbcb4a17c1140c9ef912 The package advertises itself as a browser rich-text editor, but on every new Zeditor... instantiation it waits 2 seconds and then POSTs end-user...

MAL-2026-4199 Malicious code in ts-logger-pack (npm)

ts-logger-pack is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that package when installed or imported. The terminal-logger-utils payload executes a postinstall hook that opens utils.cjs, an obfuscated malware dropper. The dropper downloads...

MAL-2026-3982 Malicious code in @antv/g6 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3406 Malicious code in ggfmttygl-new (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2098233a75602dd1779f720f566420f4a88ec77694b206e7858323b5aeea38d5 Package is disguised as a utility, but in fact loads encrypted code as modules. However, loading it requires knowing the decryption key which is not included i...

MAL-2026-3169 Malicious code in frank-newton3-db-final (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37a69c1c519dbe289ed217a75f1a31ace9b850acdb7df6cdadd95ca68f879f1d The package frank-newton3-db-final was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2965 Malicious code in build-metadata-logger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 be01b550f3d8914aa6bd8659c9a410054e4e0bf9203d33e93478eb444e957b55 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2556 Malicious code in api-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c3bf88cef3ca699f69bada95749b40c4426c9a9c528e53c473698be88cbdc783 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2025-188376 Malicious code in nuxtjs-steganography-dynamo-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b011db95a7eefc14dc52ac07963321debbf596a0cb901153713ef86d2f4e28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-42383 Malicious code in @crabas0npm/totam-aliquid-voluptatibus (npm)

The package @crabas0npm/totam-aliquid-voluptatibus was found to contain malicious code...

MAL-2025-602 Malicious code in openbet-access-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dd796ac609bd9ccd763f039c5ecfd7fd63b7c76170f3feaba70a4d2148fa881 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1003 Malicious code in w722-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74cbe1029791e4751e8b8c53fda75aa07cd3a6ca974a239c87867db522c2ee8e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-1144 Malicious code in google-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6e7f92b7d079e1dd3eac61bdcb4202ec2e5415b3925d6cf58b0a7bad0e20159f The OpenSSF Package Analysis project identified 'google-requests' @ 99.3.9 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8508 Malicious code in zoo-web-components-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a033ba4e84e9b29f5eb20d41c448241b24f20fb48b6ad382babb24543441f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8418 Malicious code in demo-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7346c8d2670e05b376c36a799aafbe36cad56e319900ab63a766fea56e0985cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8373 Malicious code in @bitsoex/react-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e89332fc8c2abca1b7c5a14da73534cf2f08bbedb6a61665dd691b87893e008 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8345 Malicious code in situs-bocoran-rtp-live-bocoran-agen-judi-rtp-slot-hari-ini-terpercaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f73b571e4c0b58abd71ef8568110602a40db42e30e5a458b2e75c844a4763c0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8161 Malicious code in rambox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63e80eb984d70eca3cfadd2c9872df353dba45f0c14111f84c9c0ab34f8b8930 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8123 Malicious code in @apps-common/ui-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis efafe7e60f7bde7ddddd2cdd0c5464da613f467cef65d985b5984f75a323a349 The OpenSSF Package Analysis project identified '@apps-common/ui-theme' @ 10.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-8 Malicious code in kangpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11daf46221ff00d16c0c8784b95eba32196bb8f5543e2d3115c2b1826215c612 The OpenSSF Package Analysis project identified 'kangpy' @ 1.0 pypi as malicious. It is considered malicious because: - The package communicates...

MAL-2022-7048 Malicious code in wavoip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 978ec410c0a4c57a05e3ebf73205f1134733f68c3c56aa50bb7f295f3e5e8c16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15814 Malicious code in chromatitle-dev (npm)

The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...

MAL-2026-15567 Malicious code in htps-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed7eca74d8fb188a8618c67facb5015d747e423ccdf4e51caae2e4e63f82ea2 Package is published as htps-provider with a README copy-pasted verbatim from the legitimate Cosmos chain-registry project advertising assets, chains...

MAL-2026-15496 Malicious code in amplitude-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110901fcd2d59ab6eed44d962da05830610e5c3cb03ca103db5a379e6c6052e4 package.json declares a single dependency whose key equals the package's own name amplitude-experiment and whose source is the bare HTTPS URL...

MAL-2026-14369 Malicious code in @syncraft-labs/vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78f28562113db7a203dc694bdff7b3884e8a6e252754b6bd845aab3fefe065f The ESM build dist/index.js of @syncraft-labs/[email protected] contains a heavily obfuscated payload injected alongside the otherwise-legitimate Vue plugin...

MAL-2026-14338 Malicious code in proc_macro1 (crates.io)

proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...

MAL-2026-14301 Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

MAL-2026-13926 Malicious code in sui-gql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86abb4ef26b5c61e261c09d96823d64e6bfac2de04c8da1c2be9b738a47a70da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13833 Malicious code in prezdentkxheiw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b524c1b4d84ba3f109eddb254753a02dac72fa61397c4f03dbcbb814c6aaa68f The package contains only index.html declared as main and package.json. The HTML impersonates a Cloudflare 'Just a moment...' challenge and includes ...

MAL-2026-13796 Malicious code in cvbmxiowkwqla6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dbfcc7e82fc725383c9578e9d53c4e69bdf6af9ba8037d2bf9fa50dce51969e Package [email protected] contains only two files and no behaviors matching supply-chain attack patterns were identified. No lifecycle scripts,...

MAL-2026-13763 Malicious code in fetch-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5c49646ea7e22e74073aa7d8c9596d7d93100c429033383e975a2ab080de28 Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' repository, README, and author metadata all reference...

MAL-2026-12685 Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

MAL-2026-12669 Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...

MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

MAL-2026-10909 Malicious code in ibreak (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10669 Malicious code in dbconnectify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a41259fb0099de58bc669907fa6fb20331d794b13008df0afb42893808e4ab The package exposes a method queryDBConnect that base64-decodes a hardcoded URL HASHKEY → https://api.jsonbin.io/v3/b/6a609e63f5f4af5e29b05907,...