239514 matches found
MAL-2026-16425 Malicious code in @wizloft/harness-commands (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 153aebb3135239cb82a30714bb331584ae8c75bb4808a75f5690c37b279e51b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16427 Malicious code in @wizloft/harness-file-providers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d9b1885f1c19ec77095cbcbc0d9b62c99c58325bcf43c71a6438c83528bc396 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16423 Malicious code in @wizloft/harness-authority (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2542159f7d73b577f433cb116a9daa153a2fe6ec1732e7e1c5619dcb0d81aefc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16428 Malicious code in @wizloft/harness-memory (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f75e92a7cec5020ee919ce491b7a30dfc43594192c2f6fc5aa18d42cd3bed75f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16431 Malicious code in @wizloft/harness-plugin-memory-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3c19162b88e3e800090cd1ebf21d351e27126fa964f4084286612b1637bb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16426 Malicious code in @wizloft/harness-evidence (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1e54dc6763e284dc9a6e7c32583fed8ff36a3a8f7e3c825f6582f679759772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16429 Malicious code in @wizloft/harness-plugin-file-events (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0ed60b35df86f2e566ba9ced2508d217d9dd009210bbf0e6cfea17520930ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16430 Malicious code in @wizloft/harness-plugin-file-memory (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16422 Malicious code in @httttt/mcp-npx-fetch-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73432c5cbb8e74b1a4b66e91fdbde0eda311176dbef0301b13605d75bdd299ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16475 Malicious code in memoryos (PyPI)
On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...
MAL-2026-16476 Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)
On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...
MAL-2026-16421 Malicious code in kerokwis (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 118186230c3ddb5c23ae32df8fed10655f2c64939daa9a09d5ef71f16884a4f0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-16420 Malicious code in kerokwis (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b2921b86b5414d75ef09db29e36e70d66085361090c4a55f83878b14463996ef The OpenSSF Package Analysis project identified 'kerokwis' @ 99 rubygems as malicious. It is considered malicious because: - The package...
MAL-2026-16419 Malicious code in @gsutevil/hta-stage (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 590b3432b8d849d5772e3be7a4fbc7daeca4aa927be2d411aaf3054d9a223dc9 The package ships a Windows HTA/WSH loader that installs a remote MSI on the victim host under the control of a base URL supplied at runtime via...
MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...
MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...
MAL-2026-16413 Malicious code in @tvg-mar/promos-gtm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...
MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...
MAL-2026-16416 Malicious code in @tvg-mar/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstruct...
MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...
MAL-2026-16466 Malicious code in wurl_show_data (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...
MAL-2026-16411 Malicious code in no-fun (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b9d03f97112ed77c073cd246f4cc95b0ff69acf9888ee9fd6682f8acee4e44f The OpenSSF Package Analysis project identified 'no-fun' @ 999.99.99 rubygems as malicious. It is considered malicious because: - The package...
MAL-2026-16410 Malicious code in auclean (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...
MAL-2026-16409 Malicious code in ubiquiti-agents-link-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4 The package's bin entry index.js runs execSync'id' and collects os.userInfo.username and os.hostname, then HTTPS-POSTs the JSON payload to the...
MAL-2026-16408 Malicious code in snap-queue (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bb29642def9150e89bacf4da4e1a64f7bc972cd145053cbb0feee0baa768f3 The sdist's setup.py defines a wusboot function that is invoked at module top-level before setup..., so it runs automatically on pip install...
MAL-2026-16407 Malicious code in poly-check-b (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...
MAL-2026-16406 Malicious code in crypto-trader-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e855a3ce62e35b613e702e710b81900769c241707c80f6a61462df0927529c The package presents itself as a crypto trading and backtesting toolkit, but ships no library code matching that description — SOURCES.txt lists only...
MAL-2026-16405 Malicious code in tailwind-form-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 353df78be0134825a2efc6d7e4d4cbf25dfba4d057925e64fc117e78a3f2814a The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is heavily obfuscated obfuscator.io-style rotated string...
MAL-2026-16395 Malicious code in envparse3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 910a8a8e205bc9a9540696320007c14926950b5a4f832efc577f2fd67ddc80a4 On require'envparse3', the package's main entrypoint invokes a top-level function dispatchAnalytics that reads a bundled image dist/stest.jpg, extrac...
MAL-2026-16392 Malicious code in envforge2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9033f3a6856b87cc07c657d93ce184d02db70e8bb67ea2319e634b7531640c11 [email protected] ships a hidden Windows dropper that fires automatically both on require'envforge2' via dist/index.cjs and on invocation of the bundle...
MAL-2026-16394 Malicious code in envparse2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59aed7381a2a7026336f5e79671e05e9313688533ca35e15cf7010a975c2c897 On require of the package's main entry and on invocation of the dot2env CLI, the module reads the bundled dist/stest.jpg, parses JPEG markers, and...
MAL-2026-16403 Malicious code in node-env-buffer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0011ed2fd25fdc35a89f50c2eb1d7d895210908c637be0fcaca077d032baaee6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16393 Malicious code in envforge3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3770550d6db043006c8b2aa75dcac951db1cd9eb7494b0259d7eb69d28f26e32 On require of the package's main entry, dist/index.cjs invokes dispatchAnalytics at module top level. That routine reads dist/stest.jpg, extracts byt...
MAL-2026-16404 Malicious code in sysverify (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7edfe23ae0c8a79c155c23e410616585061296886bb752d734feb1b2180ffc82 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16401 Malicious code in ndmckauxuoincv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd29f430051fb1e4809ff59728851a683aa0fc25eabec2f807067e928245222 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16400 Malicious code in ndmcjcxiebysfdb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6d78591ddbd2abc8045f5bdbe7694d000b3508dc8df6393ffd46d093351ef4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16391 Malicious code in cloudndmcedu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52078708a6f96873c6cd92997b0c1bc150b94ea6f0346a224a4ae7c82511be7e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16402 Malicious code in ndmcmsujey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d10bd4751b8aa4de0e747f955230af0c50c2df3f6423f0a88cbcf392d0410d8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16398 Malicious code in luftmvfiwgxydes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e487d10b32b0e42f4ed6478fa461451bcacc8eb9d679a58931bc474c339feae7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16397 Malicious code in kambxjowhdsgyw (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 966589b88833a788509808e69f3fd935c370ff4093b9fc3fb50482431434a6b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16396 Malicious code in fdhcxvnwhjiofv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7125babb23f8900d46ed2c500ef373d4de463c6260810c17719922435bdac54 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16399 Malicious code in lufxchwmxwyps (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 429d0ebe2bf5d42b37720d76547ef6105c01c3276283fd64836d42ed209d732a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16390 Malicious code in oracle-redis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6 The package publishes as oracle-redis but ships a verbatim copy of the ioredis README, source tree, and repository URL...
MAL-2026-16389 Malicious code in noverojava (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7fbf0d1519b05868b34e9e2c1d3588a0596003a5cb53e4cd28fd3a856ecff26 package.json declares the runtime dependency libsignal as github:tenka-san/libsignal-node rather than a registry version range or pinned commit SHA. ...
MAL-2026-16388 Malicious code in nodetokyo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec0e3f7b963353d4d2928e12ca3898cce5100ed3e3537383faa9c7f9a93f203 The package's declared main launcher.js executes launch at module top level, so require'nodetokyo' automatically installs Python 3.12 via winget or b...
MAL-2026-16542 Malicious code in zeal-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4b9b4fcb0a48aa3602fc7bc865eff738f8ab42a4c9e56ea31e70b0b6b826f canary.js in [email protected] collects host reconnaissance data os.hostname, os.userInfo, process.platform, cwd, node version and POSTs it to the...
MAL-2026-16541 Malicious code in zeal-util-hooks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c9ed95500d2f1c637bcf47151a9220c0a81ee6cbd7a7aa4a8f66c74fed6e341 postinstall.js and index.js load canary.js, which POSTs a JSON payload to https://npm-canary.aveliscare.com/beacon at install time and on require. Th...
MAL-2026-16540 Malicious code in style-class-utils (npm)
--- -= Per source details. Do not edit below this line.=-...