MAL-2026-3976 Malicious code in @antv/g2-extension-ava (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3911 Malicious code in @antv/g-canvas (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3550 Malicious code in @uipath/insights-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4a14d8ee3cc65fe720a880c72000a911cbc45433f4113501a7246c018798380 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-3433 Malicious code in @beproduct/nestjs-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eead7b1c6446924fec345e042b8bd966ea184deae755f876326cf99040f5f107 The package @beproduct/nestjs-auth was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3419 Malicious code in msal-browser-1p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b048f9df96df1367009fbcb80c4ad7b3ed89133bfe1fd86324c74e1c2d681c81 The package msal-browser-1p was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-3162 Malicious code in apple-pki-cert-validator (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...

MAL-2026-2981 Malicious code in @bmg-web/bmg-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b59b2c3d1c98e7a5f4faae9549ed4f302c9273e1efeaee63e70f3013300327c2 The package @bmg-web/bmg-button was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2987 Malicious code in @bmg-web/bmg-external-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6373b00808251dd64521cfb1864a0bf382c5df23e976984dea8dbebf925bbb63 The package @bmg-web/bmg-external-link was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2977 Malicious code in ts-utils-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8a1476a3763d6093218666ee76d28124242e541f10e98fea5e396de93e97e85 The package ts-utils-dev was found to contain malicious code. Source: ghsa-malware 780475532d255944bb4846b6f84becadf429014e623c83b5ca508b6f97e39a9a A...

MAL-2026-2968 Malicious code in @bitunix/test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b083a0a29a743f00a18c62069ede0cd31fa3656e9fcbafd497ff742c3efcbdd8 The package @bitunix/test was found to contain malicious code. Source: ghsa-malware caf5aa976643b0e7d9daa1d676c83032b7725f54e4d0f7541e163251805fb9df...

MAL-2026-2102 Malicious code in storefront-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f98f783cc760be758abd241914b7bb745e69248c87c20f1b84d14a522676413a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-2116 Malicious code in reqpack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2b2e7d451cecf418103df6ecbe4625c5b08cc561e843e00f4ec37efde665c320 These packages are used as build dependencies of malicious packages in newer waves of the campaign 2026-02-urllib-slim. They are used to split the malicious...

MAL-2026-1689 Malicious code in chain-promised-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9260393814045a3ce0ce9a27ff97fffcbaad7b38ad91f54d8cad995c3deb43af The package chain-promised-async was found to contain malicious code...

MAL-2026-1677 Malicious code in chai-cli-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9f4be84db26d0ce71d5bcfda424b1af08abddc37c23d3a2ef2b4263534fde2 The package chai-cli-async was found to contain malicious code...

MAL-2026-1505 Malicious code in transform-jscript (npm)

The package 'transform-jscript' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1502 Malicious code in better-styled-components (npm)

The package 'better-styled-components' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-698 Malicious code in tableshow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4fe9c764b4cb621cdd65c3dee4c4cf00cc273aab33642ebce5690b3d5c8d71e1 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

MAL-2025-187881 Malicious code in luna-xanadu-aquarius-barnard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbc41d7b808faaf60c42dff26f6f47331e3bd6a23a51389d3ae2a88c7c0f9c7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-161511 Malicious code in nabuf-otin-dofpohjau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56583a36eac2459b72c9f43b0eefa2bafa495c664e7d7ad6a211c899ae9b1583 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-49357 Malicious code in bcryptjs-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0be16faac6783f82014ca8cf99ad85fccf1d5e8a161d5b601a50ae9d6376727 The package bcryptjs-node was found to contain malicious code. Source: ghsa-malware 9ed37910e4f94c2d5eb3552347636ce0b38ce92c42cb7abf643ca2cffd60e8af...

MAL-2025-41268 Malicious code in api-react125 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d2f6ad3f3d48477a940b0ade2ae623d9001486fb2dee5c4f448fa429a9165879 The OpenSSF Package Analysis project identified 'api-react125' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6692 Malicious code in aiohappyeyeballs (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2059da56cd060292843a9bf0b02a2c41b90d84e83b5b15aa59580a8bc9084a23 The OpenSSF Package Analysis project identified 'aiohappyeyeballs' @...

MAL-2025-4092 Malicious code in keypair-encrypt-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a2d0ae49bf40dbf55ae8f036a2014dccfa4ad0194cebdc787acbfb69658df40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12021 Malicious code in playwright-1.48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c425d60dd5426771b56cc598b6cb55fffa7b0444728b06e2d6126389582b0707 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11648 Malicious code in notoken887 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-10104 Malicious code in phantomdecoderss (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9171 Malicious code in new-script-pubg-emulator-bypass-ldplayer-smartgaga-new-version-aisbev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5654e2f0697b7c2fe602792c52d1b2b7eab0d1c6f26459220b247c0a87a5b11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11640 Malicious code in mumuplayer12 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f5e7ec41057042474a89cfaa47532d1f790110bc7ac08533ff4dbeea9ee91899 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...

MAL-2024-6938 Malicious code in hack-cards (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3954 Malicious code in where-to-watch-shazam-fury-of-the-gods-fullmovies-free-on-at-home (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1163 Malicious code in paysafe-gpf-as-communication-lib-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 997f87146bcd457b4e2cb94ddbcfbb3730c96dd9a2b5843fcabcbb9456cf899d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8754 Malicious code in discord.js-selfbot-dmallfriend-v13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2862e33768120b0d69a6831c644ace7f6b507c1437f5200c7169f568077ec72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8563 Malicious code in azureml-contrib-daskonbatch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fbb97c227c663215810abd8867643e6709416bf4e16526391cc0c740f9dce047 The OpenSSF Package Analysis project identified 'azureml-contrib-daskonbatch' @ 1.0.0 pypi as malicious. It is considered malicious because: - T...

MAL-2023-8525 Malicious code in schibsted-ufo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a28167ab8729dd1bbb8263b5862e431e6df15135343db190e75aab652e104eea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8521 Malicious code in bds-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb86d6e10a764d9de055f1e941aaabd3c07c262bd4182f27d8258212ed8c0169 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8510 Malicious code in objectish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93c6856eaed07800e522a1ada1efa263f95a262db6b3050b3928f8c1fbf8b357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8504 Malicious code in plugin-getting-started (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b95fa1847620d5c168b65bdb2d2753b26090a68b3c1f7846edd359a80d3e34f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8502 Malicious code in flink-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e9f73b295599c7e74ec00ae60260502674bcb6b7077f1845295691fee703495 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8470 Malicious code in jest-coverage-report-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a570942cc8be879311bbb1b601f658554c30fa3734aacac08c1c53289da55bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8404 Malicious code in eslint-plugin-blade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aae9177af783553501be9b3995cd5eebfa3a3aaef47e65237aa9f29e4630b64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8402 Malicious code in fuzzer-gui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b32a7fd36a831bd074988f7054a6dca65651d07aafc8d97dc75c6f907a59895 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8313 Malicious code in @binter/inputs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8af4ce9af4a8aa4c73b982ed9efd19d17852cb4bf25a3d88ee221b98956cf9b4 The OpenSSF Package Analysis project identified '@binter/inputs' @ 1.7.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8314 Malicious code in data-layer-v8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e4c8f846b0ddb1097d47c477e40c0ce16ee83df9e0e4d2ad331a6f638a0c0e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8303 Malicious code in rocketmoney (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c74848dd285d1b4df9e891b6a02c21b1167ee60909824af678d6f7cd57d8ae0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8301 Malicious code in @siigo-arquitectura/mf-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 519c8b7461f58c38192ea55bcd67f43659de4537eb6031f1882e2e2dee1acbee The OpenSSF Package Analysis project identified '@siigo-arquitectura/mf-helper' @ 5.0.1 npm as malicious. It is considered malicious because: -...

MAL-2023-8583 Malicious code in pyowler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9df2ac0489cd9816fc13f309f73773ae3fc26794b44dd4930ab92a367115899f Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-1561 Malicious code in cncf-interactive-landscape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d2b9d2c5124b5a628ea48abf890a34baae186cb6a3844fc2617ad57b21be8d9 The OpenSSF Package Analysis project identified 'cncf-interactive-landscape' @ 1.0.6 npm as malicious. It is considered malicious because: - The...

MAL-2023-1467 Malicious code in ynf-dx-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6dfe1e0b8085faef3ed0105448c3cc1d7f7bba72ab13023a2eb5ba38827da39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1130 Malicious code in cdp-ops--ts-accesslog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3f91b885ec95bb15b4a6f58f71cccba8ac7528ef5c5bcae18f34f74e27f0f444 The OpenSSF Package Analysis project identified 'cdp-ops--ts-accesslog' @ 1.4.3 npm as malicious. It is considered malicious because: - The...

MAL-2023-611 Malicious code in mv-browser-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8942832656feb0a5ad201155c0335c5e5d8bd5c8fa7efcb575a25b9542327cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...