112174 matches found
MAL-2026-17884 Malicious code in getpubip (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6a07d6dd387bbd88252ffdda7f8c10daf988f0622250daf20e7ec8ee0f63c6d5 During import, obfuscated code downloads and executes an infostealer. Campaign shares some similarities with the campaign 2026-10-fontcase. --- Category:...
MAL-2026-17883 Malicious code in py-worm (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d4c5838f30da7c1f684305ec0704ef37e963793449390f5b13a4e06212ccbd9d The package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine. --- Category: MALICIOU...
MAL-2026-17882 Malicious code in tailwindcss-uniform (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f1697009648c97e7dd3a40ca390dc89a11bef7b8af037d249021e5a74a874a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17876 Malicious code in @xxxfnbs21/hello-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69ca1e29da88b95415d443f6911d2facdbabec1a0cd7b756594ffdf4336e1442 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17868 Malicious code in @kre64/hello-npm-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 654ab50c81e138ba0fcc4b3775bc84574656f528ae4de5770a6441e850fdf8c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17879 Malicious code in @flexmr/ui (npm)
@flexmr/[email protected] runs node beacon.js preinstall, node beacon.js install, and node beacon.js postinstall during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to 177.7.60.239:48080 and encode the hostname in a DNS query und...
MAL-2026-17862 Malicious code in fontcase (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9e2c4992e5295f2b094f3c7c2b2e6c2dbc8d0d9ca6242d58318e6e1b83a4255c During import, the package downloads and executes an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...
MAL-2026-17855 Malicious code in opencode2-linux-arm64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4a8829a49ed8b89e9b5b2e55e453eb1cec86c288c766ed209e907ee331a76f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17858 Malicious code in opencode2-linux-x64-musl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5865a6de931f6eeceeaa7735203a1da71c5d55a10a580273fc8111210a14eaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17857 Malicious code in opencode2-linux-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf9deaf78da8cb6d551cd438b47ce0b248159ff7ee5768fd54427262a271be93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17856 Malicious code in opencode2-linux-arm64-musl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29d77295b1fca10788c9203f4cddd81390c2257ed49c9f260838bf5c383bab8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17854 Malicious code in opencode2-darwin-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5536c7ac30ec68d1e8ab9f64da77fa154f6d1806df263ad0abaf3af38ab0e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17851 Malicious code in yoodan-github-single-ver-pkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5ec21b694320e65a8b1f38838f14f00ed00b3b1e4f6a5d6aeef960f900d1d55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17869 Malicious code in @mntv-analysis/ui (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 99.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
MAL-2026-17871 Malicious code in @mntv-analysis/workspaces-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 65.11.3 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', whic...
MAL-2026-17875 Malicious code in monkey-tags-ip (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 53.4.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'ip.js', which...
MAL-2026-17873 Malicious code in @newspage/libx-amount (npm)
npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In versions 99.99.4 and 99.99.41...
MAL-2026-17870 Malicious code in @mntv-analysis/ui-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 50.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
MAL-2026-17847 Malicious code in npp-ml (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool. --- Category: MALICIOUS - The...
MAL-2026-17443 Malicious code in @zanta/baileys (npm)
This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...
MAL-2026-17846 Malicious code in @yudzxml/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96357918fec8e046fe049ec94c614ab988e412532ace70beeb64d737533c3a30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17843 Malicious code in @xrelly-stack/bails (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50a8bf97baef2afe279a36ada416d0c235247d68c31748c360ca9bf863cdbe49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17845 Malicious code in node-telegram-sockets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaa0928c7e6cf97f1059c7c8ec8ea2c1ffe53c127480bfe8f5081b489676d26d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17840 Malicious code in @wanzlonelyy/bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b1103787a1c723a0e4102acd15834c5420336480aec1e6dc37ba741937f735a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17381 Malicious code in @wanzlonely/bails4u (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17839 Malicious code in @wanzlonely/bailsme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f3eccacfdf2ece39dce55b7c1ba8330f39be88659053a43713fb16e39b6e2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17379 Malicious code in @sakataoffc/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17836 Malicious code in @saazkira/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c02ddff50116449dec10c106e58ae0c84f16919145b8e13ddea1a23b0f00e9c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17835 Malicious code in @saazkira/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 716e747d34d02e4d4b2d34558753e65ce26a72e086b5c2388427d22eb2b0e969 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17377 Malicious code in @saazkira/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17833 Malicious code in @revizahoshii/hoshino-voip (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 505d5a8535239db195966648019eb5584f9add49d96347a260c4d184c81e08ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17829 Malicious code in @revizahoshii/hoshino-store-mysql (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0b408e63765025424d6570c3bd05bd6e01534734e6613fabee59696d11d1f15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17830 Malicious code in @revizahoshii/hoshino-store-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 413598986f6891c8b092769e99f8995809b19b477eb3dff36899d857aec516ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17376 Malicious code in @revizahoshii/hoshino (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17375 Malicious code in @revizahoshii/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17826 Malicious code in @revizahoshii/hoshino-media-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65fe484d1302a25cb129e7fb56ebbf059f4c9469a85abc10ac695e605e34dcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17821 Malicious code in @fazzcodestudio/fbot (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02d04f078ee45b434a2f48ebecea2fc18811a6830ab2e24baccea6e577baa0e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17820 Malicious code in @fazzcodestudio/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d9a7ab4b8ee5eb018dda5e7d3b273e9bc690364e24d4ece93d1107cfa791d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17822 Malicious code in @fazzcodestudio/mediaformater (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2777e6e1aff40e693fdc759b07014c5ad7c6b24fbd40d3b3cdb8d2f32c6249ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17340 Malicious code in @astracode/byles-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17823 Malicious code in @modss/libsignal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78daaf334cc6740c70b214309f4bf742a863b8c3c421076490cdb84790dd9550 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17814 Malicious code in @mikudeveloper/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4749ec89d8c51729fbd97994a6a035ab229a56bb1094c4c47d9a3d68df050711 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17367 Malicious code in @mikudeveloper/grace (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17815 Malicious code in amprem (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a1fce1d60e5a65e3872606d1167bd97dde29477b3d541736a537955c7dfe132 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17361 Malicious code in @kanaraa/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17360 Malicious code in @jojoxyz/condemnedforce-baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17355 Malicious code in @ikanngeming/ikannbail (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17817 Malicious code in nakkinpm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 331be4e62118311084ef5b928ef3bedc450c59ffb7433d02246886cf501727dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17809 Malicious code in minecraftaccfinder (PyPI)
minecraftaccfinder was published to PyPI on 2026-10-12 in six versions within 23 minutes 0.1.2 at 01:05 UTC, 2.0.0, 0.3.0, 0.3.1, 0.4.0, 3.0.0 at 01:28 UTC with no description, author, README or project page. The package consists of one module, minecraftaccfinder/init.py about 87 KB, 88 functions...
MAL-2026-17808 Malicious code in @s4yhiitestpoc/r2-https-b (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e89449bafb4f816bd8605f45cedf0fec8ec0cff9088007a7a38aaea0a9db91ec On npm install, postinstall.js automatically collects installer-side identifying data — hostname, username, home directory, non-internal network...