100496 matches found
MAL-2026-16453 Malicious code in semver-bump-io (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c66af9c077b6704b080c07e6aeca29f2f569668ee0bed678a9d370cc886051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16459 Malicious code in webp-https-errors (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 447aba02eddd7913b1520b8d21892e996cecbdf100ba2a772cbff3cb14fa74f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16442 Malicious code in moudeva (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dec843001e36153e09f56c056031d90bf3bcf909a5fe0469f8b27cbed7361c3a The package's main.js references childprocess at multiple locations lines 19, 883, 961 alongside HTTP POST calls lines 365, 369 to a hardcoded endpoi...
MAL-2026-16441 Malicious code in moidevl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b05c7a5581562edc719cbaaf2f6b317d322a6a2ef96c9fc905b53394e42101 Despite a README describing a 'Windows diagnostic utility,' the package implements an anti-proctoring overlay for cheating on remote exams Safe Exam...
MAL-2026-16451 Malicious code in luftzxyuiwgbgsp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28fe33e3ef1fb00e811cf24d940bb469190f27f2759963838cedbdf4e5d4da09 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16452 Malicious code in mob4zchvuine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f22c6a37f547c13e9444268b7cf9484c580ec5e15d5e6a1207bdcdfc7be2ff35 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...
MAL-2026-16439 Malicious code in internallib_v550 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648 Package internallibv550 is named to resemble an internal private library and is published to the public npm registry, matching the classic...
MAL-2026-16436 Malicious code in efhthrthrthregerht (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4845639223c486cf2d33751ad950cea4c7f70401877929d25c36e7d07655d820 The package's postinstall hook runs index.js, which collects the installer's OS username, current working directory, hostname, and local IPv4 address...
MAL-2026-16433 Malicious code in @vitemirrorte/element-plus-vite-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d616b037ed0b4ebbb3a3ddf36963379ea00d4b5f8513641db05e7773dd2696c9 On npm install, package.json's postinstall runs postinstall-run.cjs which chains through bootstrapGradleLifecycle → activateDaemonBridge to materiali...
MAL-2026-16426 Malicious code in @wizloft/harness-evidence (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1e54dc6763e284dc9a6e7c32583fed8ff36a3a8f7e3c825f6582f679759772 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16431 Malicious code in @wizloft/harness-plugin-memory-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f3c19162b88e3e800090cd1ebf21d351e27126fa964f4084286612b1637bb40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16429 Malicious code in @wizloft/harness-plugin-file-events (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0ed60b35df86f2e566ba9ced2508d217d9dd009210bbf0e6cfea17520930ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16428 Malicious code in @wizloft/harness-memory (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f75e92a7cec5020ee919ce491b7a30dfc43594192c2f6fc5aa18d42cd3bed75f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16423 Malicious code in @wizloft/harness-authority (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2542159f7d73b577f433cb116a9daa153a2fe6ec1732e7e1c5619dcb0d81aefc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16430 Malicious code in @wizloft/harness-plugin-file-memory (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5791ca0cb9f6e9f35dbdec168cfa44f58498fe5559a99ba8d46dd5f28eff38c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16476 Malicious code in @memtensor/memos-cloud-openclaw-plugin (npm)
On September 23, 2026, an attacker published malicious versions of two MemTensor packages. The affected packages are the OpenClaw plugin @memtensor/memos-cloud-openclaw-plugin on npm and the MemOS Python library MemoryOS on PyPI. Both versions contain the same Go implant, sckit. The binary runs i...
MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...
MAL-2026-16412 Malicious code in @tvg-mar/promos-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68c9eeb2e4516c9cab13b7e00458e54cccac15ab6c28eda25b2138ceeeab60f3 The package's install lifecycle script runs node index.js, which loads runtime/support/telemetry/probe/impl.js. On every npm install, that module...
MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...
MAL-2026-16415 Malicious code in @tvg-mar/tvg-promos-atomic-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22c22841398a01b681136598baf046a8ad9ad9ef6d728899a0fbce056ff66369 The package's package.json declares an install lifecycle script that runs node index.js, which loads runtime/support/telemetry/probe/impl.js. That fi...
MAL-2026-16466 Malicious code in wurl_show_data (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 17d2e80b42383fadbe9bde12ef17decad8b9dfa9b48f93b6e7f9162091e2a69d The OpenSSF Package Analysis project identified 'wurlshowdata' @ 3.1.42.99 rubygems as malicious. It is considered malicious because: - The...
MAL-2026-16410 Malicious code in auclean (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...
MAL-2026-16409 Malicious code in ubiquiti-agents-link-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8827e987697ea6ef619055c53ae1654800a838c18419ffc8a09e872c6f16adc4 The package's bin entry index.js runs execSync'id' and collects os.userInfo.username and os.hostname, then HTTPS-POSTs the JSON payload to the...
MAL-2026-16407 Malicious code in poly-check-b (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6 During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing. --- Category: MALICIOUS - The campaign...
MAL-2026-16394 Malicious code in envparse2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59aed7381a2a7026336f5e79671e05e9313688533ca35e15cf7010a975c2c897 On require of the package's main entry and on invocation of the dot2env CLI, the module reads the bundled dist/stest.jpg, parses JPEG markers, and...
MAL-2026-16392 Malicious code in envforge2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9033f3a6856b87cc07c657d93ce184d02db70e8bb67ea2319e634b7531640c11 [email protected] ships a hidden Windows dropper that fires automatically both on require'envforge2' via dist/index.cjs and on invocation of the bundle...
MAL-2026-16400 Malicious code in ndmcjcxiebysfdb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6d78591ddbd2abc8045f5bdbe7694d000b3508dc8df6393ffd46d093351ef4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16391 Malicious code in cloudndmcedu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52078708a6f96873c6cd92997b0c1bc150b94ea6f0346a224a4ae7c82511be7e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16397 Malicious code in kambxjowhdsgyw (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 966589b88833a788509808e69f3fd935c370ff4093b9fc3fb50482431434a6b5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16398 Malicious code in luftmvfiwgxydes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e487d10b32b0e42f4ed6478fa461451bcacc8eb9d679a58931bc474c339feae7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16388 Malicious code in nodetokyo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ec0e3f7b963353d4d2928e12ca3898cce5100ed3e3537383faa9c7f9a93f203 The package's declared main launcher.js executes launch at module top level, so require'nodetokyo' automatically installs Python 3.12 via winget or b...
MAL-2026-16540 Malicious code in style-class-utils (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16539 Malicious code in speaker_tagging_media_player (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16537 Malicious code in spark-common (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16536 Malicious code in mx-www-locales-common (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16534 Malicious code in halali-sample (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16531 Malicious code in @yuva2210/okx-poc-preinstall (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16532 Malicious code in @yuva2210/poc-depconf (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16529 Malicious code in @larocas-bbresearch/tp-probe-e29834ce (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7279432ffb7dc233307df869ac5faaded0fef16333ec8a5948b15bae7bd716a7 The package was found to contain malicious code or consuming dependency that contains malicious code...
MAL-2026-16528 Malicious code in @larocas-bbresearch/tp-probe-dc7a3670 (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16520 Malicious code in @egencia/uitk-react-layout-flex (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16514 Malicious code in @client-web-next/utils (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16512 Malicious code in @client-web-next/ui (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16510 Malicious code in @client-web-next/transfer-state (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16511 Malicious code in @client-web-next/ua-parser (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16508 Malicious code in @client-web-next/tarjeta-button (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-16506 Malicious code in @client-web-next/origination-microfront (npm)
--- -= Per source details. Do not edit below this line.=-...