MAL-2026-16457 Malicious code in tibcwmpoeafh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8972beee1619a236a6811896c8f7c2bded94a428c0de8f6861e7ef956b63fb9a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16450 Malicious code in kamafhbnowct (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 646021a6b47fafd23415f7357b91660f4ce18545fa5f9b2ba370842c632fb92d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16460 Malicious code in xsjukcnv8low26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18a0eb3bfed72107b77ceb231f89637cb4efe0babbceae9e2bc84873fed6a3f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

MAL-2026-16443 Malicious code in my-company-device (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbd39b4115bf373ff8f8d036f1db1cdb58e1fb3712d3330eabad7dbc5796ac4f Running npx my-company-device appends a hardcoded ssh-ed25519 public key labelled sunyiting-macmini to the installer's /.ssh/authorizedkeys mode 0o60...

MAL-2026-16439 Malicious code in internallib_v550 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648 Package internallibv550 is named to resemble an internal private library and is published to the public npm registry, matching the classic...

MAL-2026-16440 Malicious code in turbo-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a25d8c29cbfb317e1c88568514a999618bdeee25b2716b76e3db5062e9dd7a67 package.json at line 43 declares the sole dependency 'node-net-pool' as an HTTPS tarball of the 'main' branch of an unrelated GitHub account...

MAL-2026-16434 Malicious code in catplatebarcodeparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189a06b0d55d6dab795bcb9ba3a97aa855b2556a54e85e15adc9f5bf20399976 [email protected] declares preinstall and postinstall lifecycle scripts that execute scripts/run.js on npm install. That script reads...

MAL-2026-16435 Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

MAL-2026-16437 Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

MAL-2026-16436 Malicious code in efhthrthrthregerht (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4845639223c486cf2d33751ad950cea4c7f70401877929d25c36e7d07655d820 The package's postinstall hook runs index.js, which collects the installer's OS username, current working directory, hostname, and local IPv4 address...

MAL-2026-16433 Malicious code in @vitemirrorte/element-plus-vite-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...

MAL-2026-16432 Malicious code in @wizloft/harness-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 328a1e142939c4523f9be9f14f94ae40f314f2c8ff7f2531e7474c02100ec523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16427 Malicious code in @wizloft/harness-file-providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d9b1885f1c19ec77095cbcbc0d9b62c99c58325bcf43c71a6438c83528bc396 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16424 Malicious code in @wizloft/harness-cli-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f530bcd1820c18dbf9109139f6895ba89b5bec5b18ac374b85398844c0eabccf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16425 Malicious code in @wizloft/harness-commands (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 153aebb3135239cb82a30714bb331584ae8c75bb4808a75f5690c37b279e51b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16431 Malicious code in @wizloft/harness-plugin-memory-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3c19162b88e3e800090cd1ebf21d351e27126fa964f4084286612b1637bb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16430 Malicious code in @wizloft/harness-plugin-file-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16423 Malicious code in @wizloft/harness-authority (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2542159f7d73b577f433cb116a9daa153a2fe6ec1732e7e1c5619dcb0d81aefc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16429 Malicious code in @wizloft/harness-plugin-file-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0ed60b35df86f2e566ba9ced2508d217d9dd009210bbf0e6cfea17520930ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16428 Malicious code in @wizloft/harness-memory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f75e92a7cec5020ee919ce491b7a30dfc43594192c2f6fc5aa18d42cd3bed75f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16426 Malicious code in @wizloft/harness-evidence (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1e54dc6763e284dc9a6e7c32583fed8ff36a3a8f7e3c825f6582f679759772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16422 Malicious code in @httttt/mcp-npx-fetch-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73432c5cbb8e74b1a4b66e91fdbde0eda311176dbef0301b13605d75bdd299ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16475 Malicious code in memoryos (PyPI)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

MAL-2026-16476 Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)

On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...

MAL-2026-16421 Malicious code in kerokwis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 118186230c3ddb5c23ae32df8fed10655f2c64939daa9a09d5ef71f16884a4f0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-16420 Malicious code in kerokwis (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b2921b86b5414d75ef09db29e36e70d66085361090c4a55f83878b14463996ef The OpenSSF Package Analysis project identified 'kerokwis' @ 99 rubygems as malicious. It is considered malicious because: - The package...

MAL-2026-16419 Malicious code in @gsutevil/hta-stage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9 The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...

MAL-2026-16413 Malicious code in @tvg-mar/promos-gtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...

MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

MAL-2026-16416 Malicious code in @tvg-mar/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstruct...

MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...

MAL-2026-16466 Malicious code in wurl_show_data (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...

MAL-2026-16411 Malicious code in no-fun (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package...

MAL-2026-16410 Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...

MAL-2026-16409 Malicious code in ubiquiti-agents-link-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4 The package's bin entry index.js runs execSync'id' and collects os.userInfo.username and os.hostname, then HTTPS-POSTs the JSON payload to the...

MAL-2026-16408 Malicious code in snap-queue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bb29642def9150e89bacf4da4e1a64f7bc972cd145053cbb0feee0baa768f3 The sdist's setup.py defines a wusboot function that is invoked at module top-level before setup..., so it runs automatically on pip install...

MAL-2026-16407 Malicious code in poly-check-b (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...

MAL-2026-16406 Malicious code in crypto-trader-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e855a3ce62e35b613e702e710b81900769c241707c80f6a61462df0927529c The package presents itself as a crypto trading and backtesting toolkit, but ships no library code matching that description — SOURCES.txt lists only...

MAL-2026-16405 Malicious code in tailwind-form-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 353df78be0134825a2efc6d7e4d4cbf25dfba4d057925e64fc117e78a3f2814a The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is heavily obfuscated obfuscator.io-style rotated string...

MAL-2026-16403 Malicious code in node-env-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0011ed2fd25fdc35a89f50c2eb1d7d895210908c637be0fcaca077d032baaee6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16395 Malicious code in envparse3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910a8a8e205bc9a9540696320007c14926950b5a4f832efc577f2fd67ddc80a4 On require'envparse3', the package's main entrypoint invokes a top-level function dispatchAnalytics that reads a bundled image dist/stest.jpg, extrac...

MAL-2026-16392 Malicious code in envforge2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9033f3a6856b87cc07c657d93ce184d02db70e8bb67ea2319e634b7531640c11 [email protected] ships a hidden Windows dropper that fires automatically both on require'envforge2' via dist/index.cjs and on invocation of the bundle...

MAL-2026-16394 Malicious code in envparse2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59aed7381a2a7026336f5e79671e05e9313688533ca35e15cf7010a975c2c897 On require of the package's main entry and on invocation of the dot2env CLI, the module reads the bundled dist/stest.jpg, parses JPEG markers, and...

MAL-2026-16393 Malicious code in envforge3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3770550d6db043006c8b2aa75dcac951db1cd9eb7494b0259d7eb69d28f26e32 On require of the package's main entry, dist/index.cjs invokes dispatchAnalytics at module top level. That routine reads dist/stest.jpg, extracts byt...

MAL-2026-16404 Malicious code in sysverify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edfe23ae0c8a79c155c23e410616585061296886bb752d734feb1b2180ffc82 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16401 Malicious code in ndmckauxuoincv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd29f430051fb1e4809ff59728851a683aa0fc25eabec2f807067e928245222 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16400 Malicious code in ndmcjcxiebysfdb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6d78591ddbd2abc8045f5bdbe7694d000b3508dc8df6393ffd46d093351ef4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...