MAL-2022-4691 Malicious code in monorepo-symlink-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85ce41560ca4bda849205f0e30456947dd54daec43938385934ce240e45546a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1693 Malicious code in -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-index-main (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3009 Malicious code in shazam-fury-of-the-gods-2023-full-online-free-on-streaming-at-index-main (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-36856 Malicious code in thunder-iris-jur448-project (npm)

The package thunder-iris-jur448-project was found to contain malicious code...

MAL-2024-7969 Malicious code in legacy-swc-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e695d88baed2f53db3da619c1ea2230342d8f853e21cfba4ba15019326e6ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-23230 Malicious code in injectapp-org-injection-of-apps-and-news900 (npm)

The package injectapp-org-injection-of-apps-and-news900 was found to contain malicious code...

MAL-2023-462 Malicious code in fsevents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acdc3ae57250fab51aeff6e3938ed40197a1b74eb688a72cd5d7eee0c77a7167 This advisory is intended to inform the npm ecosystem with details to resolve a third-party malware incident that may have impacted your infrastructure i...

MAL-2024-9182 Malicious code in script-updated-roblox-redwood-prison-reworked-script-c5bqbv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b78659fb6218288f54c62b3f447a830fb0280c0b956bf43c74841db5510e7955 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4933 Malicious code in npm-cli-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb10e3aadb85207426e2f19a15effbe518d2292152d572f7bdd6e0f3fd24b0e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-21003 Malicious code in fs (npm)

The package fs was found to contain malicious code...

MAL-2024-11458 Malicious code in solara.dll (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-18386 Malicious code in 789bet-vip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89f42dbd0e59f1a22fcf7bc79133a84da721ea78a4be37c6a0fe77775cf28c45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10319 Malicious code in appdynamics-libagent-napi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3ccb8490c24108245e9e5e4893518e881e48f0dafa4b0ad152ab458de4e7b1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6022 Malicious code in eslint-config-prettier (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2022-2945 Malicious code in extraneous-dev-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e08815dacf458e78940833dd89e08a808779aabda6f12833e3ca42e28a3d0cdf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8346 Malicious code in situs-slot-gacor-pragmatic-play-dijamin-menang-tahun-2023 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cd7a331fb814fa537c53d27be98d58490ef24e73e0720abf83775b181ba3501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10225 Malicious code in mobileye-8-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e7b3a006f16102113625364a266a513016fe138d66a4008fc548e6df97c1a9a8 The OpenSSF Package Analysis project identified 'mobileye-8-connect' @ 7.7.8 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1539 Malicious code in angl-archtslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e5d9cbbc6608e412a429d0d62fb5d10c38aa9be4ceb86df876f1f1aaafeb52ec The OpenSSF Package Analysis project identified 'angl-archtslint' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2022-276 Malicious code in @flameshot-org/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfc208be31b8f932d6175ac98e7ddc5249c25d6e735a9af5a2c8266770cb9a45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14070 Malicious code in @ai-vertical/ai-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3daa0f3fabdeebe3db0146233d623d65ae16aea601e54fd6519a160db5af8ee On require/import, index.js fetches a hardcoded GitHub Gist gist.github.com/aiverticalsolutions/7676451d2f972137d2482c4a8937a77a via the api.github.c...

MAL-2022-2944 Malicious code in extraneous-detected (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c37443660cc0f4d7112c362734a5370d76c45d1444f9ae76efbac3b4bbed71e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7286 Malicious code in xnxx-dl-wa-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ae97fc6d17d4a931da57669f1fc5dcd02644f5a8c9c0f8d9a416f741c15368a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17255 Malicious code in @hrmony/benefit-mobilitaet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf87d41e53e59a65644aaf92de291a5943afa017fbdc2068ebb6741383f60688 On module load, index.js unconditionally contacts the EC2 Instance Metadata Service at 169.254.169.254, obtains an IMDSv2 token, and retrieves instan...

MAL-2026-11735 Malicious code in @or-sdk/users (npm)

npm/@or-sdk/users is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

MAL-2026-18395 Malicious code in bq-helix-build-hook-6ade983e (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ee26602dfa25f574d440b2c1e8ef0a9516fdfb5db4b59f995b88784332476413 During installation the code collects information from the environment, including credential files, environment variables, data from cloud metadata endpoints,...

MAL-2025-191843 Malicious code in python3-6 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d48e27507362baa15b8e41d1554bce82077fcc870112ab6cb4d17694b47c8ef3 During installation, the obfuscated code is run and connect with a remote server. In the current version, the code just opens a URL without exfiltrating any...

MAL-2025-22760 Malicious code in http (npm)

The package http was found to contain malicious code...

MAL-2026-11971 Malicious code in flat-cache (npm)

npm/flat-cache version 6.1.24 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

MAL-2026-11970 Malicious code in file-entry-cache (npm)

npm/file-entry-cache version 11.1.6 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-18393 Malicious code in orderbook-volt-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c5e43ffd87e59e00afe190ca8f2a09ac3afaa366f19506c570b8ace7dec0c5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11033 Malicious code in dogwiftools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 072830cdf24f92d02ea5bb6ca4b9c474b7fa3a234ddfb1b98eaaccbc8cc06842 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18396 Malicious code in bq-helix-recon-6ade983e (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9663aaa7e713f47d83da712da5653aa7d3e1919fd70419d9fc5749145f575b17 Package places PTH/sitecustomize files triggering execution of malicious code on every Python startup. The code then collects information from the environment,...

MAL-2024-955 Malicious code in @time-loop/electron-panel-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd04a51a89e2d496efa31e8eacb197a77e0fe700b691b0a07851de06f9312514 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-873 Malicious code in adsscriptloaderstatic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b68c5c565d5e74ccb2314d025daaf561be580a1b406cd797cd5d8f02d13c3c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18375 Malicious code in @dmangal/curse-dependent-ecto (npm)

@dmangal/curse-dependent-ecto contains no library code index.js in 99999.0.0 and 99999.0.2 only exports its name and version and was published on 2026-10-28 between 21:59 and 22:19 UTC with inflated version numbers 99999.0.0 to 99999.0.2. It ships a binding.gyp and package.json sets "gypfile":...

MAL-2026-5617 Malicious code in sysnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eac9873e59ffdf79c56fd4f9366b56e0532f87dc00c4380fae18d714785b0bc8 On require / CLI invocation, sysnu performs two install-time-equivalent actions on Windows hosts. First, if python is not on PATH, index.js lines 42-...

MAL-2024-2063 Malicious code in dashboard (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

MAL-2026-13604 Malicious code in tailwindcss-motion-advanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b8426c39ffcba11d95e8ede8085ce260dbcf8527544ce9ca3a1d7a59618f0eb On require of the package's main entry, lib/utils.min.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth, eth.drpc.org,...

MAL-2026-2144 Malicious code in litellm (PyPI)

litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source the v1.107.0 git tag of BerriAI/litellm does not contain them: they were injected at build or upload time. Every whee...

MAL-2026-2853 Malicious code in react-hook-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17ae372e5061ef357237d48a7812ca65bbc3a49b8a57153df5812d17e9d8eeaa The package react-hook-form was found to contain malicious code. Source: ghsa-malware 5aa9ba7a4ea0b89453bdd073b8ffb80b6e3baab6684d5652a1e898c2bacb5a6...

MAL-2026-18379 Malicious code in @jasperquinn/postcss-motion-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 781da369bb3fa6b157a3ae9e923e3311a8b1bfc6ab3af00b31401240e443a652 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5590 Malicious code in rapidjson (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d8cde70e5ebdf9f1f3ca47531c69bd833ee151e87b26e71cab845eba16fdbe4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11558 Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-18234 Malicious code in reedworker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e3e7e4b377a02ec129d648a7b048736d59389c30267009fc378ed3c1e48dbc Analysis of reedworker 0.1.0 on PyPI surfaced no indicators of supply-chain attack behavior. No install-time or import-time network activity, no...

MAL-2024-7752 Malicious code in jfrog-ci-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ca6b5be5ca78626dbb231ce098412b200202572a0c8a3513b2a666e342d8004 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12174 Malicious code in xeno.dll (npm)

This package uses obfuscation to hide that its downloading a malicious binary from an attacker-controlled domain --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8903fab539c0352f278ee3116807f48f52403f7e26b855fe9d68c3328012200d Any computer that has this package...

MAL-2026-15524 Malicious code in tabbables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb package.json at line 11 declares a dependency whose key equals the package's own name tabbables and whose value is the raw HTTPS URL...

MAL-2025-28475 Malicious code in Orchestrator (npm)

The package Orchestrator was found to contain malicious code...

MAL-2025-48945 Malicious code in terrastruct-d2-bin-win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bec005a1e4b23bc2e97201bde7e77e009276fac62af29f61c4c657a081d3f10 The package terrastruct-d2-bin-win32-x64 was found to contain malicious code...

MAL-2024-1139 Malicious code in boukiapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e9af3c6aabc1d88faf00494cf4894995cd20b96fb4b40a1d4bf32c98f3fd782 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...