239514 matches found
MAL-2026-4953 Malicious code in @cloudplatform-single-spa/notification-gateway (npm)
Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...
MAL-2026-4834 Malicious code in @polka-ui/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 662c2a1b8ad5d264ec01b078f95c130c96398305ba009a2c2de33cc9d7db7486 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-4355 Malicious code in mistral-workflows-plugins-webhook (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e87825efe9006ca3d435869b276f0d8526a1255ec71ac6e7aa0ea1bb068b6673 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-4727 Malicious code in weavedb-warp-contracts-plugin-deploy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a98f87e329831590a7416ca47a949a7b21cf8e948491e875d8359ca8d5cc5959 package.json declares "preinstall": "./tools/setup", which is a 976 KB Linux x8664 ELF binary shipped in the tarball with no source, no build system,...
MAL-2026-4726 Malicious code in weavedb-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2da95bd75489853f6b09a9aef5a5ee03ee6715b41dac446d29f273c750027a3 package.json declares "preinstall": "./dist/runtime.node", which directly executes a 976KB Linux ELF binary at every npm install. The .node extension...
MAL-2026-4408 Malicious code in @nolimit-x/win32-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 343787b335da015be56f49d118534c54bf81abab9e53b40bec0114d23bcc95c7 Package ships a single 8.1 MB Windows PE nolimit-core.exe as its main entry with only the description 'nolimit-x native binary for Windows x64' — no...
MAL-2026-4305 Malicious code in auth0-net-sdk-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9cf6a5c13db1c0846ba64abd842d9980dddd9c0d66d3497d549779ccaea114b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-4626 Malicious code in omnius (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aceac0879b587bc711c3f156bf0de4bab90f3774816a6cbeb36a2cf9bb03e12 The package's postinstall lifecycle hook launches dist/postinstall-daemon.cjs, which combines childprocess.execSync, os.userInfo, filesystem probes,...
MAL-2026-4773 Malicious code in vlifegram (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8771013473b84f29159a80ec15ce3e9897bc69908ddfa2438845811dd276d87c VLifeGram is published under its own name on PyPI but installs into the pyrogram/ namespace and ships a Pyrogram fork at version 2.1.2.4. It adds an...
MAL-2026-4700 Malicious code in venturo-playwright (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 602d8b957dc823f0dd6ac61f115e23fce1b433683873a9f4f8351dcbe9a37035 Package presents itself as Microsoft's Playwright: package.json description 'A high-level API to automate web browsers' is Playwright's exact tagline...
MAL-2026-4002 Malicious code in @antv/gi-assets-galaxybase (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3913 Malicious code in @antv/g-compat (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3429 Malicious code in openai-spellchecker (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 13911c4c1e0334b4e4d972e3b3256a08f8991d3935d74086c252ed085d3984a0 The package hides code to download and execute a next-stage payload, which then communicates with C2 and listens for next code parts. In the analyzed version,...
MAL-2026-3428 Malicious code in xxx-bale (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 1109b5dc74c94551027044e54e20f9c1c18f89d53da6af87861ba4773eae1966 The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigge...
MAL-2026-924 Malicious code in auto-backup-macos (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 64b97d3c3597539dc5a2cc2d81491eb2a0350011b3d80ef927546bc30701f924 Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...
MAL-2026-42 Malicious code in pyrogrom (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ef643052c84683fba662eaded2786ba6fa993e69224608070ad949d4f3d0c3e4 The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category:...
MAL-2025-187045 Malicious code in framework-orbit-query-kardashevscale (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 143313a7ae8dac1e177b19d5f45c2056a89330f8ec31efee8e6eaba5a6c1f050 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-6828 Malicious code in @seznam-diskuze/embed (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 03c95e188163b615484b4882358ea8d4a9411661fa3bb701052fd608c8f6c4b7 The OpenSSF Package Analysis project identified '@seznam-diskuze/embed' @ 100.2.0 npm as malicious. It is considered malicious because: - The...
MAL-2025-2383 Malicious code in eslint-plugin-highcharts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07b07952c4a78f4c462a288e6a648a238e98bc0232aa1e4bf6a0e5ad25bf3507 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8535 Malicious code in frontend-components-react-transpiled (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 463e9359f450d451e47eef2a46a82e6d6fe266ffa312c37239b9e2fda0a440fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8523 Malicious code in shein-lego (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ef45c393ee6ca8301bbc37b170265fd5ea03cca45f8e48d8e1c1b085c05665 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8307 Malicious code in narratives-from-tweets (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1570135eff60eea1dfd9ec7b66797d9454373263050b83c8ad90d2b7b37d71b6 The OpenSSF Package Analysis project identified 'narratives-from-tweets' @ 0.1 pypi as malicious. It is considered malicious because: - The...
MAL-2023-8290 Malicious code in poc-nvk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10eb10880328aea55a7c7620d283f145ebcb574bfc98567eef9ad44d1ee8fcdb The OpenSSF Package Analysis project identified 'poc-nvk' @ 0.1.2 pypi as malicious. It is considered malicious because: - The package...
MAL-2023-8371 Malicious code in tencentcloud-python-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx c79d20c4af5b69c3506d69fb847d2f5306a83433cb56e391c8dbf828e9728319 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...
MAL-2026-16108 Malicious code in @auction-fe/reporting-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a41fe4ef01818c699bc5c1953702b37cb566a58b0b4769a7ae532b05699b130 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15491 Malicious code in eip712-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...
MAL-2026-14367 Malicious code in @syncraft-labs/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efe219063a966d0d2025d6c3274cbc7e9f3c0b3a1e9cdf81c7adf6dbae4d4ac The ESM build shipped at dist/index.js contains a heavily obfuscated payload hex-identifier string-array + rotator produced by an obfuscator.io-style...
MAL-2026-14356 Malicious code in lumen-pages-community (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7c1d6b7b99791f7bbd5999021f109bef569a6c681eda0bb6196b459b12a3808 [email protected] declares a postinstall hook node dc.js that runs automatically on npm install. dc.js collects the installer's hostname,...
MAL-2026-13789 Malicious code in bmgki3g6fh3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9212dc22bc5983b7b163b7851e76596bda812485709581a8dd61475630db4450 The package contains a single file, index.html, declared as main. The page renders a spoofed Cloudflare 'Just a moment...' / Turnstile 'security...
MAL-2026-13683 Malicious code in kotoraka (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...
MAL-2026-11803 Malicious code in @qlik/runtime-module-loader (npm)
npm/@qlik/runtime-module-loader is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11523 Malicious code in cache-manager (npm)
npm/cache-manager version 7.2.10 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...
MAL-2026-8785 Malicious code in slt81847 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-8118 Malicious code in newhacksvn1778556129 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-6938 Malicious code in pinokio-redis (npm)
pinokio-redis is a malicious npm package and part of the multi-wave "forge-jsx" cross-platform RAT campaign Wave 4. It was published by npm account 'donimique' [email protected]. The package.json description 'Node.js integration layer for Autodesk Forge' and the bundled README.md literally...
MAL-2026-6580 Malicious code in loadutils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31f1f1f6292d782062f6fff1f7422d9f1dc0eb1572e4372d6c0d574ccea3ab3a Package loadutils is a typosquat of the widely-used webpack helper loader-utils. The shipped README documents the loader-utils API urlToRequest,...
MAL-2026-6431 Malicious code in leo-streams (npm)
The leo-streams npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...
MAL-2026-5985 Malicious code in node-path-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180db640dc8207694eb4629834f74b740d7efc9febf26067d190e10656fe04e9 Package name node-path-utils and its README/description claim it is 'an exact copy of the NodeJS path module', impersonating the Node.js core path...
MAL-2026-5887 Malicious code in conducts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fc899376af9cf86b0ddfddeb5e2a904ce8a5109fc293b0c115c1f7e3633fe2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-5799 Malicious code in boardflow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d5c1524281430272215f48a90b957cf08f76dcb9954cb73945421dff358eb2 package.json declares preinstall: node install.js, which fires automatically on npm install. install.js is heavily obfuscated obfuscator.io...
MAL-2026-5543 Malicious code in jailbreak-code (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f729dde017c78154685be850893a9f3ebd58bf0b5cb1229e7e49fb09b14f5d5 The package presents itself as an AI developer CLI but is engineered as a credential and payment harvester. src/c2.ts hardcodes a Discord webhook URL...
MAL-2026-5460 Malicious code in fhirproxy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96e092973bad8e995bdec34000e45943e0be59996e84f181ee4bee9cd423f8eb [email protected] is a thin loader package whose only behavior is to pull and execute the dependency fhirproxy-utils. package.json declares both...
MAL-2026-5280 Malicious code in bramin (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fb2ac40fcb4626c5e7dea5e26951bc0965b39a1eb721c1a8f23846f421a5827 bramin ships a bramin-setup.pth file that Python auto-executes at every interpreter startup system-wide, not only when bramin is imported. The.pth...
MAL-2026-5130 Malicious code in @redhat-cloud-services/integrations-client (npm)
Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...
MAL-2026-4887 Malicious code in @cloudplatform-single-spa/anti-ddos (npm)
Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...
MAL-2026-4788 Malicious code in @godscene/web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1bd83a63f0426cc7c4e1a68886c36ff47de093d9b7edc6b410d16c928be50c1 Package @godscene/[email protected] is a re-bundled copy of the legitimate @midscene/web at the same version, preserving the original description, README,...
MAL-2026-4785 Malicious code in test-nonmal-pkg-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f52d81c9285fd103cfe5f8dc724c173c1b4e57e96cd56313cec119fbbbc9982 index.js is hex-name-obfuscated 0x-style string array and, on require, enumerates the entire process.env via Object.keysprocess.env into a snapshot...
MAL-2026-4714 Malicious code in wdb-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05323f987b64131618be124040867a2acb216aef96952a6a3dfc11c615501500 package.json declares "preinstall": "./dist/runtime.node", causing npm to spawn the shipped file as an executable on every install on Linux. Despite...
MAL-2026-4721 Malicious code in weavedb-node-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d174728fc7469b023ece1980797185c35abd74c56e253bc1dc1b295a46a1dbd2 package.json declares "preinstall": "./tools/setup", unconditionally executing a 976KB UPX-packed, stripped Linux x86 ELF on every npm install. The...
MAL-2026-4731 Malicious code in wml-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46afe229d6efe1ef10d025302ed21e5c2c44bdd772c8fbb28d037cb1215c84ba [email protected] is a dependency-confusion package targeting an internal wml- namespace, published with an inflated version 99.0.1 to win npm resoluti...