72461 matches found
MAL-2026-16467 Malicious code in @test1230504/probe-7f3k2m-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 941e9925e20dd460b4dc52c0981a140d58ed376e41b15457cbd6bcd5028ba0d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16472 Malicious code in z-deno-truth-ya1t4m (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4ca6bf79ee3672fa881c285bd8af8fc4af19fb3be8e90212de7e8a0be70cf30 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16465 Malicious code in helpersutils-dev-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673 The package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to...
MAL-2026-16461 Malicious code in godxxx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22893c200272af03998e9f6c5df91c6e4971b3d2622a80df8eab58b98e0a9a1 cdpinject.js is declared as the package main and unconditionally calls main at module top level when the process is not invoked with --stop/--detach,...
MAL-2026-16463 Malicious code in godzzz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a The npm package [email protected] ships cdpinject.js which imports http, https, childprocess and fs at the top of the file, reads process.env including...
MAL-2026-16446 Malicious code in better-md (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d2f690a34e0e9b3a8df4caf676f30b542d8dc710033dc70ddf6e3c18ee3a1fa The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16455 Malicious code in some-tool-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e053568381d2b1cf3b7e62e3152651c843cfc3e32f056574d7a64dae4531b2e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16453 Malicious code in semver-bump-io (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c66af9c077b6704b080c07e6aeca29f2f569668ee0bed678a9d370cc886051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16449 Malicious code in iso-datetime-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9db51cfb135f41debd79f82f4bd905994ecdb54d08811d3755ac66aed13cb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16442 Malicious code in moudeva (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a The package's main.js references childprocess at multiple locations lines 19, 883, 961 alongside HTTP POST calls lines 365, 369 to a hardcoded endpoi...
MAL-2026-16452 Malicious code in mob4zchvuine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f22c6a37f547c13e9444268b7cf9484c580ec5e15d5e6a1207bdcdfc7be2ff35 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...
MAL-2026-16436 Malicious code in efhthrthrthregerht (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4845639223c486cf2d33751ad950cea4c7f70401877929d25c36e7d07655d820 The package's postinstall hook runs index.js, which collects the installer's OS username, current working directory, hostname, and local IPv4 address...
MAL-2026-16433 Malicious code in @vitemirrorte/element-plus-vite-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...
MAL-2026-16428 Malicious code in @wizloft/harness-memory (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f75e92a7cec5020ee919ce491b7a30dfc43594192c2f6fc5aa18d42cd3bed75f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16423 Malicious code in @wizloft/harness-authority (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2542159f7d73b577f433cb116a9daa153a2fe6ec1732e7e1c5619dcb0d81aefc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16426 Malicious code in @wizloft/harness-evidence (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1e54dc6763e284dc9a6e7c32583fed8ff36a3a8f7e3c825f6582f679759772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16430 Malicious code in @wizloft/harness-plugin-file-memory (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16431 Malicious code in @wizloft/harness-plugin-memory-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3c19162b88e3e800090cd1ebf21d351e27126fa964f4084286612b1637bb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...
MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...
MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...
MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...
MAL-2026-16466 Malicious code in wurl_show_data (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...
MAL-2026-16410 Malicious code in auclean (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...
MAL-2026-16407 Malicious code in poly-check-b (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...
MAL-2026-16392 Malicious code in envforge2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9033f3a6856b87cc07c657d93ce184d02db70e8bb67ea2319e634b7531640c11 [email protected] ships a hidden Windows dropper that fires automatically both on require'envforge2' via dist/index.cjs and on invocation of the bundle...
MAL-2026-16394 Malicious code in envparse2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59aed7381a2a7026336f5e79671e05e9313688533ca35e15cf7010a975c2c897 On require of the package's main entry and on invocation of the dot2env CLI, the module reads the bundled dist/stest.jpg, parses JPEG markers, and...
MAL-2026-16391 Malicious code in cloudndmcedu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52078708a6f96873c6cd92997b0c1bc150b94ea6f0346a224a4ae7c82511be7e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16400 Malicious code in ndmcjcxiebysfdb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6d78591ddbd2abc8045f5bdbe7694d000b3508dc8df6393ffd46d093351ef4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16398 Malicious code in luftmvfiwgxydes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e487d10b32b0e42f4ed6478fa461451bcacc8eb9d679a58931bc474c339feae7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16388 Malicious code in nodetokyo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec0e3f7b963353d4d2928e12ca3898cce5100ed3e3537383faa9c7f9a93f203 The package's declared main launcher.js executes launch at module top level, so require'nodetokyo' automatically installs Python 3.12 via winget or b...
MAL-2026-16540 Malicious code in style-class-utils (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16537 Malicious code in spark-common (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16534 Malicious code in halali-sample (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16531 Malicious code in @yuva2210/okx-poc-preinstall (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16532 Malicious code in @yuva2210/poc-depconf (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16528 Malicious code in @larocas-bbresearch/tp-probe-dc7a3670 (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16514 Malicious code in @client-web-next/utils (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16510 Malicious code in @client-web-next/transfer-state (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16511 Malicious code in @client-web-next/ua-parser (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16508 Malicious code in @client-web-next/tarjeta-button (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16502 Malicious code in @client-web-next/footer (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16501 Malicious code in @client-web-next/feature-flags (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16495 Malicious code in @client-web-next/adaptive (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16491 Malicious code in @adominadmininstr/fmt-date-helper (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16490 Malicious code in @adominadmininstr/date-util-helper (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-17152 Malicious code in mega-clean-box (RubyGems)
--- -= Per source details. Do not edit below this line.=-...