MAL-2024-1144 Malicious code in google-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6e7f92b7d079e1dd3eac61bdcb4202ec2e5415b3925d6cf58b0a7bad0e20159f The OpenSSF Package Analysis project identified 'google-requests' @ 99.3.9 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8508 Malicious code in zoo-web-components-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f5a033ba4e84e9b29f5eb20d41c448241b24f20fb48b6ad382babb24543441f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8418 Malicious code in demo-saas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7346c8d2670e05b376c36a799aafbe36cad56e319900ab63a766fea56e0985cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8373 Malicious code in @bitsoex/react-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e89332fc8c2abca1b7c5a14da73534cf2f08bbedb6a61665dd691b87893e008 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8123 Malicious code in @apps-common/ui-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis efafe7e60f7bde7ddddd2cdd0c5464da613f467cef65d985b5984f75a323a349 The OpenSSF Package Analysis project identified '@apps-common/ui-theme' @ 10.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2022-7048 Malicious code in wavoip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 978ec410c0a4c57a05e3ebf73205f1134733f68c3c56aa50bb7f295f3e5e8c16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15496 Malicious code in amplitude-experiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110901fcd2d59ab6eed44d962da05830610e5c3cb03ca103db5a379e6c6052e4 package.json declares a single dependency whose key equals the package's own name amplitude-experiment and whose source is the bare HTTPS URL...

MAL-2026-14301 Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

MAL-2026-13833 Malicious code in prezdentkxheiw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b524c1b4d84ba3f109eddb254753a02dac72fa61397c4f03dbcbb814c6aaa68f The package contains only index.html declared as main and package.json. The HTML impersonates a Cloudflare 'Just a moment...' challenge and includes ...

MAL-2026-13796 Malicious code in cvbmxiowkwqla6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dbfcc7e82fc725383c9578e9d53c4e69bdf6af9ba8037d2bf9fa50dce51969e Package [email protected] contains only two files and no behaviors matching supply-chain attack patterns were identified. No lifecycle scripts,...

MAL-2026-12685 Malicious code in delivery-ci-update-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad7aaa115c4d227fa01dd5a8b2e9f6945b21c65a7df4433ecf527ef69b3d0b40 On require, index.js loads adapter.js which fetches an unsigned, unhashed platform-specific executable from hardcoded Cloudflare Workers subdomains...

MAL-2026-11120 Malicious code in @ai_/autoprefixers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bffb6e00dd7cc6edb63e3890139943019f9fa0868440ecc46cb61482416bc3d @ai/[email protected] is a typosquat of the popular 'autoprefixer' package. On require/import of the main entry, the module base64-decodes the stri...

MAL-2026-10909 Malicious code in ibreak (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10669 Malicious code in dbconnectify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a41259fb0099de58bc669907fa6fb20331d794b13008df0afb42893808e4ab The package exposes a method queryDBConnect that base64-decodes a hardcoded URL HASHKEY → https://api.jsonbin.io/v3/b/6a609e63f5f4af5e29b05907,...

MAL-2026-10499 Malicious code in eth-lib-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13895e2e8ee4aa9683c2fd6f0f873a38b19bbc5af207233e22c51668bc7dba41 Package [email protected] impersonates @ethereumjs/util / ethereumjs-util README, author list, repository URL, and source tree copied from the...

MAL-2026-6547 Malicious code in react-editable-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef4c5725bd98fb80c8dc59c58f68627b6a69aa4c4ae16d3f0c70c011895144cb package.json declares a preinstall hook node src/utils/index.d.js, but the published tarball's files whitelist ships only dist/, README.md, and LICEN...

MAL-2026-6083 Malicious code in syncagents (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aebf468a6887fb09002d4ae4aceab77e347034b389b02e252844f7d0d81fabd6 The PyPI package 'syncagents' impersonates the legitimate PyPI package 'agentsync' — the README, PKG-INFO, CHANGELOG, and project URLs all point at...

MAL-2026-6171 Malicious code in personal-custom-button (npm)

The npm package personal-custom-button published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-5920 Malicious code in pretie_x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0da1230156c752bfa8b3456568e30a9eeb73c4100bff87777ae57d9f562e75 Package name pretiex2 and its description 'Opinionated code formatter for modern JavaScript and TypeScript.' with keywords including prettier...

MAL-2026-5752 Malicious code in patientdocuments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56c5ab4dc6470deaebe29f4851edb91bc5d5704e9f9578a91e238490708c007b package.json declares a preinstall lifecycle script that runs wget --quiet...

MAL-2026-5623 Malicious code in edu-npm-dependency-chain-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d5b538a93d9379ce9f4eaa885a4b22c6ec94175718176088b7a432cd67da271 No suspicious code, lifecycle scripts, network destinations, credential reads, or obfuscation were observed in this package. The package name suggest...

MAL-2026-5579 Malicious code in webpack-cache-cycle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82fa37e2478a7109e376e3a062ccb203806511033930eb7390e45fe7ef404b81 On npm install, package.json's postinstall hook runs node -e "require'./loader.js'". loader.js spawns a detached node process that decodes a...

MAL-2026-5360 Malicious code in wallet-sdk-9 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0 campaign sibling c960+. postinstall auto-execs, src/index.js harvests /.ssh/idrsa+ided25519+Sol/Eth/BTC/Tron/Sui/Aptos wallets+.env+seeds, self-labels "CRYPTO STEALER", exfils to SAME Telegram bot 8227918239 chat 6433587894 not rotated. Campaign now...

MAL-2026-5230 Malicious code in autotel-subscribers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374da77433b452664266e009188064316b6defdcb0ee4b7e391a158a0a5ca6bf No concrete installer-harm signals were identified in this version of autotel-subscribers. There is no observed lifecycle script fetching remote...

MAL-2026-4865 Malicious code in @car-loans/close-flow-module (npm)

Part of a dependency confusion attack campaign targeting the @car-loans, @fb-deposit, and @debit-ib npm scopes. The attacker npm user pik-libs published 25 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version resolution,...

MAL-2026-4770 Malicious code in spip-pth-demo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb61035c28fe642903fac1b2776b2593c1611831ce5553e63ef8b09a77e414c9 The package installs a suspicious-demo.pth file into site-packages via setup.py's datafiles="", "suspicious-demo.pth". Python auto-processes.pth file...

MAL-2026-4754 Malicious code in heims (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e7dda6f116113ebe2bd1ae1ec5238d66f8ada8a87e69a90e49aac1f4eb3f57 The package's WechatUtil.gettoken in src/heims/utils/wechat/wechatutil.py hardcodes a POST to https://token.zhangjianpeng.cn/ with md5appid and...

MAL-2026-4644 Malicious code in power-platform-playwright-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57967d58233d74f2fc4f9b0dee7c050370eb388050df8d63f29e719f83468d73 On npm install, the package's postinstall script postinstall.js collects host identifiers and CI context — whoami, os.hostname, os.platform, cwd, CI,...

MAL-2026-4363 Malicious code in @asura21232/fca-unofficial-nextgen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30540a72a722c901403164aeb090ca99999d3be2cc4d9e9f3ad99ef319fc2db2 This package presents itself as an unofficial Facebook Messenger client library, but its exported authentication helpers loginViaAPI, tokensViaAPI,...

MAL-2026-4760 Malicious code in nvidia-nat-semantic-kernel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe66a4b0f7f00b8e8a9abd877b3ab0531d56906cc11f6fa6ecaddd4b0bebbbe1 The package's METADATA declares Requires-Dist: ruamel-yaml-clibz==0.3.5, a typosquat of the well-known ruamel-yaml-clib note the trailing 'z'...

MAL-2026-4500 Malicious code in bricks-builder-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ad643457c1104b8f118971a9ee95702f2126a16f33a4ec9dfd8ed21c43fc1eb bricks-builder-mcp is a Model Context Protocol server exposing WordPress/Bricks Builder editing tools page JSON edits, media uploads, custom CSS/JS...

MAL-2026-4758 Malicious code in nebulix-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93ea83117b0ae362a2b55ad581d69b3600c81b78d2e90c19bb1ea9eea2266a4c The package's documented NebulixEngine.chat API hardcodes two Firebase Realtime Database URLs owned by the author...

MAL-2026-3936 Malicious code in @antv/g-plugin-canvas-picker (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-2963 Malicious code in typelimagic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7fcef0c386cca43024460aa4a1b47a99109e4ba02159a8fbe426c12f9884a83e Clone of a legitimate library. The added code scans system for sensitive files, with the focus on crypto currency wallets, and exfiltrate them. Previous versio...

MAL-2026-2883 Malicious code in ts-lint-builds (npm)

big.js typosquat campaign - SSH backdoor implantation, credential and crypto wallet theft --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b5b6d9da5acae076b81860b7c119f9b61dd48b9b5360e56b582fdae563f96d8 The package ts-lint-builds was found to contain malicious...

MAL-2026-1264 Malicious code in python-requirements (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 40fa77c47c3649fce85f601f8aa10bf13674e5db4a2d35f125cb48b77d65f99d The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current...

MAL-2026-878 Malicious code in magichat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b999f3f5762dc9bcb0dc2e91ef10116a368aca535d2f07fa2519e8d64bbc0902 The package is prepared to download a hardcoded executable and save it in %LOCALAPPDATA% under a very generic name, clearly aiming to hide its existence. Code ...

MAL-2026-204 Malicious code in pako-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b50aeb49929f8ce8f402d5ac0c09ee4735bc5411a45ae75dc357bfc5d18506d The package pako-js was found to contain malicious code. Source: ghsa-malware 86a948a3458aac938e35fbf5ec50b54986362543bef11c481af0f1dd3292cafd Any...

MAL-2025-191080 Malicious code in bytes-to-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d19001ff544a780ecb8d28a32f64cdd826bdeeef576c1350b61b5c699d30029 The package bytes-to-x was found to contain malicious code. Source: ghsa-malware 0c7ce92280ddc3448a5bcc7c44e7807c8e4b4226449cc6de80708d7d48b7970e Any...

MAL-2023-8513 Malicious code in ext-frontend-esignature (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dcffa9ade419d008513b815bd316ec2f2100a8a3510b692cb84a11ca2e5b2ac6 The OpenSSF Package Analysis project identified 'ext-frontend-esignature' @ 2.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2023-8469 Malicious code in react-18-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ab3496e80f456724e73563a2fef64ff6928d569e6e730832dd7de084aa0b3655 The OpenSSF Package Analysis project identified 'react-18-viem' @ 0.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8419 Malicious code in ironfish-rust-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c72ce118b54d6f7c389cffe8b206419fdb96d698e61557ce25e5240a5ca6c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8417 Malicious code in transaction-decoder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 588e3ae64f6791e490455f6c01512f655440e86bb808155dc3a0ece45f77b016 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8315 Malicious code in emob-lp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c69ecc160f72c29544fec3ce637a39a70d5d458f1e42487180d41443154116f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8100 Malicious code in healthbridge-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a45a21805510c3390a5789a690b22ba697abed37486f11b580a61895f01ab42 The OpenSSF Package Analysis project identified 'healthbridge-design-system' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1503 Malicious code in web-dev-for-beginners (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 12dfe4d59f97f208fa2c0392b71a0939ecbd509d7ccd7853cea8b3f4e13b317a The OpenSSF Package Analysis project identified 'web-dev-for-beginners' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1504 Malicious code in z-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d1df7db96fadf79c92ca77b7fd6e95a23c25f7d4c1f7507b4316730a4086d1dc The OpenSSF Package Analysis project identified 'z-foundation' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1492 Malicious code in github-deployment-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fbecfc86b0734310a1e38d002a298fffa75da0631b0309309bd26ad98188e97a The OpenSSF Package Analysis project identified 'github-deployment-action' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2022-4849 Malicious code in ngx-translate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1100a503faf33aad0489ce41d03404d9f250bc81751ec29be8109e87d9c6d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15929 Malicious code in pymaas (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d07b21485fb1007b5cca6c07b48620d235200b19dd62e8d6018d019ec5557dc On import pymaas, top-level code in the package invokes a canary function that collects the entire os.environ dictionary and socket.gethostname,...