239514 matches found
MAL-2026-10543 Malicious code in skrill-payments (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e517423e768b0086d0579e460801e0b14cb6e6751a810b23bd9f41954d92779 Package impersonates a Paysafe/Skrill payments SDK name 'skrill-payments', class PaysafeClient, spoofed 'github.com/paysafe/skrill-payments' reposito...
MAL-2026-10522 Malicious code in flick-test-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f05e70375ac31032fb4fc3abf302d1c1122bf01504f810aa74d9fe59066d36 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-10508 Malicious code in nodemon-elint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa [email protected] copies the source tree, README, author metadata, and homepage of the legitimate nodemon package but is published under a...
MAL-2026-10500 Malicious code in express-bunker (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68139b9a62e1d546de6ce2e46d5203782dbf54f1af2edbd2b8f509528eb0f000 [email protected] ships a postinstall script that performs an HTTP GET to a hardcoded bare IP over plain HTTP...
MAL-2026-10488 Malicious code in permcarmserver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...
MAL-2026-10478 Malicious code in @sectest429/hello-npm-world (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d The package advertises a single function module.exports = function helloname but ships a preinstall.js lifecycle script that runs automatically on np...
MAL-2026-10472 Malicious code in @torbeck/priority-queue (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3109ebd719fa91812bd69e50b418b78f2a04c5478924f6ff53054cb798dc937 The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info, the original author 'Eyas...
MAL-2026-10464 Malicious code in node-procmetrics-data (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ea7e26b73fb4fa21cdd545045f2a360a02d1013efe25cd6ab7aedb1fec72c9b [email protected] ships archive-sender.js which, at install/execution, tars the installer's root filesystem excluding /proc, /sys, /dev,...
MAL-2026-10409 Malicious code in cold-debug-elevator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae8ef53b42bfe7f208c404e2e973600fa174f41c5a2009814f5f0e892769195 The package presents itself as a debugging utility but its exported API is a browser credential stealer targeting installer-owned secrets. The...
MAL-2026-10253 Malicious code in abuden210 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368c280a0e86d6d687aa5789a4bca9daeacd64666dc6954dd729a7549f506a59 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10259 Malicious code in abuden216 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 136d8dabbba25b7fb10fa921d1eafe01d4f6710465dfc33ad213f02043973b49 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10282 Malicious code in acidic (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ef3583eb4d5b190d763cd784f5a40cb2cddaa8f1b6cd81b8a663bb612b51bb7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-10277 Malicious code in abuden28 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a58dd1a008e23641f5373b4593347947fb72a1a199e2354ffe75c79af4066d98 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10257 Malicious code in abuden214 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bdbebaa72ae71aae5482f3726a6be11649402b33365104e2fbf39f1db624137 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10281 Malicious code in abuden5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0425e16f6f6a24f1e657ceb1c80a24330f655a496c9d1bb22a2de0cd41423f0a The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10339 Malicious code in nottuff12 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beeb7a0cb302b59468d0c8e75f4eac559afebefdf4526e4ed0832ab6ffc738ad The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10330 Malicious code in ishowfeet9 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248f82bac5fecfd3cc8e27d3c4cc6f48f310aef9c069e64cc33a407cd79369bb The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10389 Malicious code in timmytuffknuckles6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22ef6fa6c2b9f80d6a1f79e532a9d9ea083a1c662bc834d118879ba630842b0c This package is not a Node.js library. package.json declares "main": "sw.js", a Service Worker that calls importScripts'./8cfc2/hgshm.js' — an API th...
MAL-2026-10306 Malicious code in imillegal1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b8bddd4b8345bfaacf5ad511276da43344de0033bc312123620aa6cc6e4366 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10326 Malicious code in ishowfeet5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f3dc5dbca240ed6fabdb431e41494dd64100dbf96791921a36642cb53a9403 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10314 Malicious code in ishowfeet12 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b60cb6a8169d535b5e52d5fa3cb7a1a16bf4f2d15f87d894a4111da9b74fedae The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10219 Malicious code in chai-as-precision (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b5d1218fae5d91755d8f9ca8ed37983e7d589c6fd88012d3ddb29a84a2cc56 Package is published as chai-as-precision but its shipped code mimics pino exports middleware.pino, ships pino.js/proto.js/redaction.js, a name/purpo...
MAL-2026-10228 Malicious code in chat-adapter-zoom (npm)
The chat-adapter-zoom package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Zoom...
MAL-2026-10180 Malicious code in auth-next-gen (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0926f0a2c1f47072efaac014be38bb00c8e9f31f59badf188b1ed74dd5c2ce On require of auth-next-gen, index.js loads lib/writer.js, which at module top level performs an axios GET against a base64-obfuscated URL...
MAL-2026-10157 Malicious code in notify-theme (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9cbb2ac45124e3844e29f3efd70ca26f0089ec4eaad718bcbdaf3035ec9b34b The package impersonates the pino logger API exports module.exports.pino = middleware, ships pino-style files such as lib/proto.js, lib/multistream.j...
MAL-2026-10137 Malicious code in type-elint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f29d6bfc122cb5792d95cfade56e62789f83366b30fc0d58a88a84113d89962c Package impersonates the pino logger README is pino documentation, package name is a lookalike. The main export is a middleware factory that spawns...
MAL-2026-10128 Malicious code in ohcm-culture-formatting (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5679f4434881406ce5af055e04a3ab7403158df3404c928a7fbc67596d0e9631 [email protected] declares a preinstall hook "preinstall": "node index.js" that auto-executes on npm install. index.js uses...
MAL-2026-10106 Malicious code in rallycoding (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 789e913282e371428b19e015e619b6a3dd6c8d9938ad0e08a1f37d0248d28e0a package.json declares 'rallycoding' as its own dependency, resolved from an unauthenticated plain-HTTP URL http://pack.nppacks.com/npm/rallycoding...
MAL-2026-10058 Malicious code in cookie-js-ease (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d [email protected] impersonates the popular js-cookie library same repository URL, banner comment, API surface, and reused upstream author name...
MAL-2026-10070 Malicious code in polymarket-kelly-stake-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9798cce0effcbcf5ed3295f322a375bb1a3cbb7e9db4b7d88c802bf5116639e3 [email protected] advertises itself as a pure Kelly-stake math helper but its postinstall hook scripts/install-check.cjs, invoked fro...
MAL-2026-10069 Malicious code in polymarket-kelly-maths (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc23601d9ca932f0a36a1a6e7115e37da1e984b1adf3b39b9612b72f5a3cf90f The package's postinstall script install-check.cjs resolves a bundle URL from a remote JSON config at https://jipred.vercel.app/config/clob-math.json...
MAL-2026-10079 Malicious code in vybscan-testbed-obfuscated-postinstall (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9aee5b150e0606b1c5c2469fdab43496965a3dd5664df288d68d618e326567 package.json declares a postinstall lifecycle script that runs node -e "evalBuffer.from'','base64'.toString". Installing the package triggers executi...
MAL-2026-10040 Malicious code in chai-as-balanced (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 562ae39db73c30faea0a6d84cda0fe0b68d60d7bfa863f769edcdb620e30b0a1 chai-as-balanced is a typosquat of chai-as-promised also impersonating pino via README/badges/exports that ships a remote code execution dropper...
MAL-2026-10008 Malicious code in breeze-feature-flag-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bc85f58d0fcdcfa75e143c0fb4e09095edf4d9fd3ac6d53576d58176beef49e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-7025 Malicious code in tronsev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 74ab279920219404ed526a79d48c3e9135856fd7905a135ce506c1c148557500 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
MAL-2026-7023 Malicious code in dbzy-tools (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0432a46ed92acb897826fc16d26cba900bd3d18f0de5baa7f2909a44d9ec625 The package advertises itself as a network debugging tool but its CLI and modules compose a remote-access toolkit. The dbzy-tools console entry calls...
MAL-2026-7008 Malicious code in chai-as-const (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2c70991a87f00f1b25b85243d1984fcb2562dc2c34f0c5514827b3660350294 [email protected] is a disguised dropper. The package name is unrelated to its code, which impersonates the pino logger exports pino middleware,...
MAL-2026-6983 Malicious code in tronpak (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 35790f872dd1f0fa6c17fca434134a08101946af27a0e2b4467e3b362f618e01 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
MAL-2026-6957 Malicious code in nodemon-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3900c92378db76295f8a47683d86e58b24625758b938f4cd89ac779f86ed5260 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6933 Malicious code in hook-augmenting-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fbb17d535ecc8b30b2ab54a487691ec2e427f9dbc3c0e20acad414bb25f3203 Analysis of this package version produced no static or behavioral findings indicating installer-side harm. No exfiltration, install-time code fetch,...
MAL-2026-6923 Malicious code in notifier-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...
MAL-2026-6924 Malicious code in solana-address-codec (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1008cff7bb82464ce9ade3ae5c353e929b7367800b404a038baa8a026c69ae The package name resembles utilities in the Solana ecosystem e.g., @solana/addresses and address codec helpers, which is a common target for typosqua...
MAL-2026-7410 Malicious code in rseactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7405 Malicious code in roblox-lua-promise (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7391 Malicious code in rewactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7371 Malicious code in reafctjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7368 Malicious code in reacvtjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7251 Malicious code in dontawesome (npm)
--- -= Per source details. Do not edit below this line.=-...