MAL-2026-16477 Malicious code in com.apple.unityplugin.storekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca The package impersonates an Apple/Unity StoreKit internal namespace com.apple.unityplugin.storekit and, on require, index.js performs an HTTPS GET to...

MAL-2026-16473 Malicious code in sea-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aaf4b5ddb859270a86aa6d21df680ed66fb0622434317747a6f7275ad9a3d60 sea-baileys is a fork of the Baileys WhatsApp Web library. Its package.json remaps the libsignal import specifier to...

MAL-2026-16474 Malicious code in vite-dev-launcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123 The package presents as a Vite dev-server wrapper but its declared postinstall node./postinstall-run.cjs chains through...

MAL-2026-16467 Malicious code in @test1230504/probe-7f3k2m-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 941e9925e20dd460b4dc52c0981a140d58ed376e41b15457cbd6bcd5028ba0d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16472 Malicious code in z-deno-truth-ya1t4m (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4ca6bf79ee3672fa881c285bd8af8fc4af19fb3be8e90212de7e8a0be70cf30 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16470 Malicious code in z-deno-truth-bwhlsz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db0813755b79e157c644502848b1ff5af003fc82fb842b39676490d00f33e814 The package's exports field maps the ./package.json subpath to setup.js, so any consumer resolving require'z-deno-truth-bwhlsz/package.json' executes...

MAL-2026-16464 Malicious code in hachutis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 455f1d04545c9ed17722705fe61415d7e536e2800c2a3c588ab69985004c73b9 The tarball ships three undeclared prebuilt executables under bin/ bin/cli, bin/cli-linux-amd64, and an 81 MB Bun-compiled bin/cli-http-linux that ar...

MAL-2026-16465 Malicious code in helpersutils-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673 The package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to...

MAL-2026-16461 Malicious code in godxxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22893c200272af03998e9f6c5df91c6e4971b3d2622a80df8eab58b98e0a9a1 cdpinject.js is declared as the package main and unconditionally calls main at module top level when the process is not invoked with --stop/--detach,...

MAL-2026-16463 Malicious code in godzzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a The npm package [email protected] ships cdpinject.js which imports http, https, childprocess and fs at the top of the file, reads process.env including...

MAL-2026-16446 Malicious code in better-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d2f690a34e0e9b3a8df4caf676f30b542d8dc710033dc70ddf6e3c18ee3a1fa The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16455 Malicious code in some-tool-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e053568381d2b1cf3b7e62e3152651c843cfc3e32f056574d7a64dae4531b2e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16459 Malicious code in webp-https-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 447aba02eddd7913b1520b8d21892e996cecbdf100ba2a772cbff3cb14fa74f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16449 Malicious code in iso-datetime-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9db51cfb135f41debd79f82f4bd905994ecdb54d08811d3755ac66aed13cb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16448 Malicious code in debounce-throttle-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2799630960bce0578627557c1a8c41369d2a1556f9632d6491903f17f21d7a39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16453 Malicious code in semver-bump-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c66af9c077b6704b080c07e6aeca29f2f569668ee0bed678a9d370cc886051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16454 Malicious code in solo-async-pipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 419538617e0e07800ec7fb28e19be25e6b99687548af5ba4ae82ae486daca882 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16442 Malicious code in moudeva (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a The package's main.js references childprocess at multiple locations lines 19, 883, 961 alongside HTTP POST calls lines 365, 369 to a hardcoded endpoi...

MAL-2026-16441 Malicious code in moidevl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b05c7a5581562edc719cbaaf2f6b317d322a6a2ef96c9fc905b53394e42101 Despite a README describing a 'Windows diagnostic utility,' the package implements an anti-proctoring overlay for cheating on remote exams Safe Exam...

MAL-2026-16451 Malicious code in luftzxyuiwgbgsp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28fe33e3ef1fb00e811cf24d940bb469190f27f2759963838cedbdf4e5d4da09 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16452 Malicious code in mob4zchvuine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f22c6a37f547c13e9444268b7cf9484c580ec5e15d5e6a1207bdcdfc7be2ff35 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16460 Malicious code in xsjukcnv8low26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18a0eb3bfed72107b77ceb231f89637cb4efe0babbceae9e2bc84873fed6a3f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16457 Malicious code in tibcwmpoeafh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8972beee1619a236a6811896c8f7c2bded94a428c0de8f6861e7ef956b63fb9a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

MAL-2026-16443 Malicious code in my-company-device (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd39b4115bf373ff8f8d036f1db1cdb58e1fb3712d3330eabad7dbc5796ac4f Running npx my-company-device appends a hardcoded ssh-ed25519 public key labelled sunyiting-macmini to the installer's /.ssh/authorizedkeys mode 0o60...

MAL-2026-16439 Malicious code in internallib_v550 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648 Package internallibv550 is named to resemble an internal private library and is published to the public npm registry, matching the classic...

MAL-2026-16436 Malicious code in efhthrthrthregerht (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4845639223c486cf2d33751ad950cea4c7f70401877929d25c36e7d07655d820 The package's postinstall hook runs index.js, which collects the installer's OS username, current working directory, hostname, and local IPv4 address...

MAL-2026-16433 Malicious code in @vitemirrorte/element-plus-vite-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...

MAL-2026-16424 Malicious code in @wizloft/harness-cli-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f530bcd1820c18dbf9109139f6895ba89b5bec5b18ac374b85398844c0eabccf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16432 Malicious code in @wizloft/harness-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 328a1e142939c4523f9be9f14f94ae40f314f2c8ff7f2531e7474c02100ec523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16427 Malicious code in @wizloft/harness-file-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d9b1885f1c19ec77095cbcbc0d9b62c99c58325bcf43c71a6438c83528bc396 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16425 Malicious code in @wizloft/harness-commands (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 153aebb3135239cb82a30714bb331584ae8c75bb4808a75f5690c37b279e51b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16431 Malicious code in @wizloft/harness-plugin-memory-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3c19162b88e3e800090cd1ebf21d351e27126fa964f4084286612b1637bb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16430 Malicious code in @wizloft/harness-plugin-file-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16423 Malicious code in @wizloft/harness-authority (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2542159f7d73b577f433cb116a9daa153a2fe6ec1732e7e1c5619dcb0d81aefc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16429 Malicious code in @wizloft/harness-plugin-file-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0ed60b35df86f2e566ba9ced2508d217d9dd009210bbf0e6cfea17520930ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16428 Malicious code in @wizloft/harness-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f75e92a7cec5020ee919ce491b7a30dfc43594192c2f6fc5aa18d42cd3bed75f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16426 Malicious code in @wizloft/harness-evidence (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1e54dc6763e284dc9a6e7c32583fed8ff36a3a8f7e3c825f6582f679759772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16476 Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

MAL-2026-16421 Malicious code in kerokwis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 118186230c3ddb5c23ae32df8fed10655f2c64939daa9a09d5ef71f16884a4f0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-16419 Malicious code in @gsutevil/hta-stage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9 The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

MAL-2026-16416 Malicious code in @tvg-mar/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstruct...

MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

MAL-2026-16466 Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

MAL-2026-16411 Malicious code in no-fun (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package...

MAL-2026-16410 Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...

MAL-2026-16409 Malicious code in ubiquiti-agents-link-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4 The package's bin entry index.js runs execSync'id' and collects os.userInfo.username and os.hostname, then HTTPS-POSTs the JSON payload to the...