239514 matches found
MAL-2026-4728 Malicious code in web-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edd19476eeb1c31707abe6fac6f52dbd1950a0dc25f4854ea5269d6400f8ea37 web-dotenv impersonates the widely-used dotenv package: its package.json copies dotenv's repository git://github.com/motdotla/dotenv.git and homepage...
MAL-2026-4671 Malicious code in skipshot-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fac3c49a9fc03e78a2f398a75c919221873a1ed0acd2303b6642300b04af1735 On install, dist/cli/install.js performs a POST to the hardcoded URL https://edge-gateway.botmarket.workers.dev carrying values read from process.env...
MAL-2026-4210 Malicious code in polymarket-auto-trade (npm)
A coordinated supply-chain attack comprising 9 npm packages published by maintainer polymarketdev GitHub actor texsellix, repo texsellix/polymarket-trading-bot within a 2-minute window on 2026-05-20T23:30Z–23:32Z. All packages masquerade as legitimate Polymarket CLOB trading tools while...
MAL-2026-4218 Malicious code in solidity-deploy-guard (npm)
A coordinated supply-chain attack comprising 10 npm packages published by maintainer ddjidd5640 [email protected] within a 48-hour window 2026-05-19T03:55Z – 2026-05-21T04:31Z. All packages masquerade as legitimate Web3/DeFi developer security tools MCP servers while silently exfiltrating...
MAL-2026-4743 Malicious code in buddyme (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f4ae4b8c00d27e82d54a5d2d960b1dc4f40ba15bc938355bad8421c338d6ef6 buddyme advertises a CLI agent. When installed and run, the default REPL routes every prompt the user types to third-party LLM providers Zhipu GLM at...
MAL-2026-3866 Malicious code in @antv/d3-interpolate (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-4032 Malicious code in @antv/knowledge (npm)
Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...
MAL-2026-3406 Malicious code in ggfmttygl-new (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2098233a75602dd1779f720f566420f4a88ec77694b206e7858323b5aeea38d5 Package is disguised as a utility, but in fact loads encrypted code as modules. However, loading it requires knowing the decryption key which is not included i...
MAL-2026-3076 Malicious code in axis-abc-search-address (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12745094744214b57071e8ace8ee7d5ee3f9be6e7d29d338bb4bbd01842f2705 The package axis-abc-search-address was found to contain malicious code. Source: ghsa-malware...
MAL-2026-2965 Malicious code in build-metadata-logger (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 be01b550f3d8914aa6bd8659c9a410054e4e0bf9203d33e93478eb444e957b55 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-2859 Malicious code in rblx-api (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 be690c2f32ad941003f8733406643848380c3918af421fa56c8ec0802b9c261d During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...
MAL-2026-1635 Malicious code in @polymarket-developers/clob-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 345ca83f0d4f9589714459a50b08e9f733a7d56bbb131b029748ad244a2d447b The package @polymarket-developers/clob-client was found to contain malicious code...
MAL-2025-191455 Malicious code in @kong/spec-renderer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb95018d12b664fc03fb69a58512ad0f479a61403b520ae8b325153404f3e14b The package @kong/spec-renderer was found to contain malicious code. Source: ghsa-malware...
MAL-2025-187215 Malicious code in gravity-cosmology-lightyear-inquirer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0821bef28486dae7727261c5a952106286fcb1f54501b2f0569591e12d76461 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-42198 Malicious code in @crabas0npm/ab-similique-voluptas-ipsa (npm)
The package @crabas0npm/ab-similique-voluptas-ipsa was found to contain malicious code...
MAL-2025-5090 Malicious code in tailwindcss-animate-expand (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-8573 Malicious code in @diotoborg/quisquam-libero (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ee23f30c5276a08fd77ced365412977b59424abdcc6a1e0ebca764fc53a9dcb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-12186 Malicious code in a-oder (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f7e835cce84c3bd2876cea21212f1d41b81ee568e92e90bb0ba1e2c2a1ba1370 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2024-07-weaponized-golden Reasons based on the campaign: -...
MAL-2024-2858 Malicious code in pelisplus-repelis-ver-a-man-called-otto-peliculas-completa-en-espanol (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-1144 Malicious code in google-requests (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6e7f92b7d079e1dd3eac61bdcb4202ec2e5415b3925d6cf58b0a7bad0e20159f The OpenSSF Package Analysis project identified 'google-requests' @ 99.3.9 pypi as malicious. It is considered malicious because: - The package...
MAL-2023-8758 Malicious code in sd-v13.js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61d641e6795079f0b94c5254c8bd4fb6173a3e2b92512c79c76ed351c4868d8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8432 Malicious code in qlkube-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d87aacc83b4b0b0d9201968dc75c81eee7b94e2faa03aae434e083f3c825213 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8418 Malicious code in demo-saas (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7346c8d2670e05b376c36a799aafbe36cad56e319900ab63a766fea56e0985cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8572 Malicious code in pyhjdddo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx ac1a1233d8897ffaa72bc15d95e9f16517f66801df9f3eee30f97a8dc675d7bf Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...
MAL-2023-10 Malicious code in security-util-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2309de1524c064d7eba8b0c288762426955241d23e00eaaeca7766758ab9054e The OpenSSF Package Analysis project identified 'security-util-py' @ 0.0.6 pypi as malicious. It is considered malicious because: - The package...
MAL-2022-5864 Malicious code in rum-speedindex (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a49eadf01782e0a434253a00c6ff87b88dea1bd449bcac0a138c573fae1e059c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17178 Malicious code in secure-env3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cb86188f9853b34c6dc3cf9c8259a789920326e8ddf4ae4cd3566385bba3ea1 The package presents itself as a dotenv-style environment loader but ships a Windows dropper that fires automatically on module load and on CLI...
MAL-2026-16047 Malicious code in @usemosaik/template-react-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...
MAL-2026-16024 Malicious code in blueai-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa623814be7289a45580d8333138d25b98458b558fbe67c447294944723ec844 package.json declares "preinstall": "bun run index.js", causing npm install to execute a 499KB obfuscator.io-style file via the Bun runtime. index.js...
MAL-2026-15814 Malicious code in chromatitle-dev (npm)
The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...
MAL-2026-15811 Malicious code in syswatch (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 740c9125f18d68081f742b3316d07c54727fb4aab5555a398c0c04e31ba9bb54 Importing syswatch starts a background thread that, on Windows, fetches a JSON manifest from...
MAL-2026-15628 Malicious code in mfa.io (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436 lib/cache.js reconstructs a base64-fragmented URL decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR.603-vhKDRdgKl3RalNTVUZYGPsJy2Y and, t...
MAL-2026-14331 Malicious code in exam-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cd95c1b59238861675a30a947648a2280420c11e53dcb4f8501db5cb736313 On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../public/logo.ico, DES-decrypt...
MAL-2026-14338 Malicious code in proc_macro1 (crates.io)
proc-macro1 is a typosquat of proc-macro2 published to crates.io by the account 'dtolney', impersonating David Tolnay dtolnay. Its metadata forges authors 'David Tolnay ' and points repository at a nonexistent github.com/dtolnay/proc-macro1. The library source is a copy of proc-macro2 so dependen...
MAL-2026-13969 Malicious code in @hzero-front-ui/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7821a8d1a76ccfc9b3e0649ad6b600927c9c3448ee083d47809026588daa77ca Package @hzero-front-ui/[email protected] is a hollow shell index.js is only module.exports = ; whose sole functional content is preinstall/install...
MAL-2026-13816 Malicious code in hxckdoeaqjlc8 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324cd3fd06a0d97ae5fb9263df818bc505d28ebcdda8e90814b5630de70e108 The package ships a single HTML file that impersonates Cloudflare's 'Just a moment...' interstitial. On Turnstile widget callback, embedded JavaScrip...
MAL-2026-13833 Malicious code in prezdentkxheiw (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b524c1b4d84ba3f109eddb254753a02dac72fa61397c4f03dbcbb814c6aaa68f The package contains only index.html declared as main and package.json. The HTML impersonates a Cloudflare 'Just a moment...' challenge and includes ...
MAL-2026-13686 Malicious code in chaintest (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence...
MAL-2026-11753 Malicious code in @ornikar/eslint-config-typescript-react (npm)
npm/@ornikar/eslint-config-typescript-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...
MAL-2026-11337 Malicious code in ncc-hyperapp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9647de0608c8fb354bb4e857f6649f8e617ae5e05055d108cc6ae44f9427897a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11036 Malicious code in streak-lib-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 507ee02c9717d3b99be47ab3415800fa71477716fa6be6b953cb07e0574066aa On import, index.mjs executes an obfuscated async IIFE whose sensitive strings process, fetch, fs/promises, target URL, path segments, payload filena...
MAL-2026-11002 Malicious code in habinger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56e193021af7a2102362115c0e0f4564f90f3cf86a4e867b6f02ce266ba419e5 The package's postinstall hook package.json postinstall: node test.js auto-executes two malicious flows on npm install. First, on Linux it fetches an...
MAL-2026-10753 Malicious code in a3s-code (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6062cbfbdc0c31c48564e4ec850d2ce71996d6cf12373c775aed5560c88e5434 On first import a3scode, top-level init.py invokes bootstrap.ensurenativeloaded, which performs an HTTP GET to...
MAL-2026-10275 Malicious code in abuden26 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 440fa1b32d35cf2c41253e2fd1f63095ea65ac7733fa48edc9abef43877659c7 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-9923 Malicious code in zwwmin34639 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-6756 Malicious code in vps-maintenance (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da5dcc405a10775ace9fab68ee0a5ddf9bcad770d29e20f999df6d41072e46b1 On import of dist/server/index.js, a top-level block spawns a detached shell that 1 appends a hardcoded attacker ssh-ed25519 public key comment eni@l...
MAL-2026-6757 Malicious code in vps-maintenance-paperclip-adapter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48d7d517534385e3776097217c197836517e4f4d84ef29598724c4398bfc875e On import of the server entry module, a top-level try block detaches a shell process that 1 appends an attacker-controlled ssh-ed25519 public key to...
MAL-2026-6692 Malicious code in polymarket-trading-developer-tools (npm)
Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-trading-developer-tools uses a dropper technique: a postinstall hook downloads configuration from pm-trading-dev-tools-be.vercel.app and exfiltrates data to the...
MAL-2026-6582 Malicious code in openai-agents-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 768ddf82a7644f1678a27f3037c8a3fc4fae5f00b6181d6507a49892d20a7fda On npm install, scripts/postinstall.js automatically reads a broad set of installer-side identity and cloud-configuration files — /.gitconfig and the...
MAL-2026-6539 Malicious code in db-query-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4928f7d380b79104d997e7666603726873158508c38d2c75a90c7529dd196be3 The package presents itself as a database query helper but index.js defines a method queryDBConnect that base64-decodes a hardcoded URL pointing to...