239514 matches found
MAL-2026-4865 Malicious code in @car-loans/close-flow-module (npm)
Part of a dependency confusion attack campaign targeting the @car-loans, @fb-deposit, and @debit-ib npm scopes. The attacker npm user pik-libs published 25 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version resolution,...
MAL-2026-5021 Malicious code in @mlspace/inference-build (npm)
Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...
MAL-2026-4790 Malicious code in makecoder (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf72d8ec7b803169421eb83d7ccbbdcd0af3671592775e25df2f92b33dfde5a4 scripts/postinstall.js runs automatically on npm install. When bun is not already present, it unconditionally executes curl -fsSL...
MAL-2026-4794 Malicious code in indextts-cli (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc206ef48bfccaec8e81aac2b666e2d54a4a027e8432cc1d08d3823cf333caca setup.py executes git clone --depth 1 --branch dev-3.12 https://github.com/gabry-lab/index-tts during the buildpy / egginfo / sdist / bdistwheel...
MAL-2026-4353 Malicious code in mistral-workflows (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 845e7d9c00baa23350d566fee80621733db4faa141eea3f1f983d86b15fb020a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-4717 Malicious code in weavedb-console (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cb1233d729c7aefcbe9024196bb4af52f78854aa5ed7f46afb4fa9cd59918c1 package.json declares "preinstall": "./src/compiler/native", which auto-executes a 976 KB stripped Linux ELF binary on every npm install. The binary ...
MAL-2026-4722 Malicious code in weavedb-offchain (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d267c34e35dca7091a9ab01d22a9c0a4cfde364531b8017f15f4a09785381198 package.json declares scripts.preinstall: "./.github/scripts/precheck", where precheck is a 976,568-byte stripped Linux ELF binary sha256...
MAL-2026-4725 Malicious code in weavedb-sdk-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59e557cd0501bb17925a19c5d3525fdf18f286b21750a44c0164eb7e165f55d9 package.json declares "preinstall": "./dist/runtime.node", causing npm to execute a 976 KB packed binary on every install. The file uses the .node...
MAL-2026-4323 Malicious code in nba-cdn-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6472220c5bb80d934ccb360b63359201b4f8e203bc8c173b27cd4181c15964b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-4737 Malicious code in your-unique-package-name1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a82d9cce1cd5cae0e9bae039dc08eccc18ec4494b182d11ab35c25ac4496d34 On import in a browser context, index.js creates a hidden iframe pointing at https://www.pendo.io/?builder.frameEditing=true and postMessages a...
MAL-2026-4774 Malicious code in vulndify-mcp-server (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6110bfbfb3eac275094aefd342ef273350829f83c53c480e29df1f872b335650 The package advertises itself in the README as offering only a benign hello MCP tool, but src/vulndifymcpserver/server.py registers two additional,...
MAL-2026-4760 Malicious code in nvidia-nat-semantic-kernel (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe66a4b0f7f00b8e8a9abd877b3ab0531d56906cc11f6fa6ecaddd4b0bebbbe1 The package's METADATA declares Requires-Dist: ruamel-yaml-clibz==0.3.5, a typosquat of the well-known ruamel-yaml-clib note the trailing 'z'...
MAL-2026-4490 Malicious code in auth0-templates-scripts-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed9a505fcbf6daef28b6625dcbde65ea1dd00b01c1a684debfdedfc7e5bc3643 Package name impersonates the Auth0 ecosystem. Its postinstall hook node index.js runs unconditionally on npm install and performs a multi-stage data...
MAL-2026-4214 Malicious code in polymarket-terminal (npm)
A coordinated supply-chain attack comprising 9 npm packages published by maintainer polymarketdev GitHub actor texsellix, repo texsellix/polymarket-trading-bot within a 2-minute window on 2026-05-20T23:30Z–23:32Z. All packages masquerade as legitimate Polymarket CLOB trading tools while...
MAL-2026-4199 Malicious code in ts-logger-pack (npm)
ts-logger-pack is a malicious npm package that depends on terminal-logger-utils and triggers the malicious behavior in that package when installed or imported. The terminal-logger-utils payload executes a postinstall hook that opens utils.cjs, an obfuscated malware dropper. The dropper downloads...
MAL-2026-4758 Malicious code in nebulix-ai (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93ea83117b0ae362a2b55ad581d69b3600c81b78d2e90c19bb1ea9eea2266a4c The package's documented NebulixEngine.chat API hardcodes two Firebase Realtime Database URLs owned by the author...
MAL-2026-4746 Malicious code in crw (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4324181416ad15727c0f51a30b56858c42fad99b93635922494acfe4c0f5d597 Package 'crw' impersonates the Firecrawl SDK: it declares 'firecrawl' as a keyword, replicates Firecrawl's client surface...
MAL-2026-4734 Malicious code in xorma-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd1e155ef0f73465f5fe6f401a4f90c521d5268eb65bb9bc594caa4a69732260 On require'xorma-js', a top-level IIFE in dist/index.js synchronously executes npm uninstall clsx-js && npm install clsx-js via childprocess.execSync...
MAL-2026-3648 Malicious code in auth-javascript (npm)
Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...
MAL-2026-3652 Malicious code in supabase-javascript (npm)
Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...
MAL-2026-3569 Malicious code in @uipath/resourcecatalog-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cb7666d347d87ddbbd13f929181a8d85ab38a63997fb34b91d420acd09616f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3433 Malicious code in @beproduct/nestjs-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eead7b1c6446924fec345e042b8bd966ea184deae755f876326cf99040f5f107 The package @beproduct/nestjs-auth was found to contain malicious code. Source: ghsa-malware...
MAL-2026-3426 Malicious code in mpkg123 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 df9e0498d827adeb16ea11e4a1137133d2124f039942b776f7ac098a257cd164 If executed as a module, the obfuscated code collects and exfiltrates sensitive data, including passwords saved in a browser. --- Category: MALICIOUS - The...
MAL-2026-3408 Malicious code in textwrap-ext (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 da4e8d5daae9a14e0ceb5a942afd308068957ec655cdd950b2b041934e9ec182 During installation, obfuscated code exfiltrates cryptocurrency wallet data to a hardcoded location and places a backdoor through a new authorized SSH key...
MAL-2026-3417 Malicious code in connect-perspectives-admintool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bfe776501bb847a54c18c3b5e4e57093a2d8b7bfd5daa2404ee202160ad846e The package connect-perspectives-admintool was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-3276 Malicious code in accesso-angular-cache-buster (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efe1cff5329801850c1249ccfee1e905acc9e221c3bd424534068908f73b5a07 The package accesso-angular-cache-buster was found to contain malicious code. Source: ghsa-malware...
MAL-2026-2968 Malicious code in @bitunix/test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b083a0a29a743f00a18c62069ede0cd31fa3656e9fcbafd497ff742c3efcbdd8 The package @bitunix/test was found to contain malicious code. Source: ghsa-malware caf5aa976643b0e7d9daa1d676c83032b7725f54e4d0f7541e163251805fb9df...
MAL-2026-2118 Malicious code in hash-utils-py (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4177b7c46ecbfa35116b35a2a491107d0514cd6551a447b7213ef6e097172939 During importing the module, the code attempts to exfiltrate sensitive Telegram's client session files. --- Category: MALICIOUS - The campaign has clearly...
MAL-2026-1692 Malicious code in circuit-playground (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df14ec9e065e3076946203915696c2efd4a96a737eac1605e10665c2276d7ca7 The package circuit-playground was found to contain malicious code...
MAL-2026-1670 Malicious code in chai-as-prop (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d21e75438243773776319743f074531328a3b7c3a72438ca9d3fdcc7c2adb74 The package chai-as-prop was found to contain malicious code...
MAL-2025-187755 Malicious code in less-loader-gulp-yaml-crust (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a37ba6b2766ddc09a8955e32126156706d18cd48cf81fa1da83c4c563b856dfc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-42383 Malicious code in @crabas0npm/totam-aliquid-voluptatibus (npm)
The package @crabas0npm/totam-aliquid-voluptatibus was found to contain malicious code...
MAL-2025-27320 Malicious code in netsuite-suitetalk-wsdl-v2020-1.0 (npm)
The package netsuite-suitetalk-wsdl-v2020-1.0 was found to contain malicious code...
MAL-2025-191743 Malicious code in gpu-free-ai (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0846b9b18e7af4ddef44ca9cb92d5543ace58ee3f171080b1570c3f044749dec Code attempts to exfiltrate any env variable containing "key" in name. This action is triggered on multiple occasions thanks to overwriting module loading and...
MAL-2025-191914 Malicious code in typing-extensions-plus (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 78c15498f688e49c1d6a8b369eae95e0e77016cd05d74f89a72fa9e845c71da5 Importing the module starts code responsible of exfiltrating crypto tokens and API keys. Package imitates typing-extensions --- Category: MALICIOUS - The...
MAL-2025-3251 Malicious code in helper-compilation-targets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e897d466d55977bfca32e3649ff28dc2c596464148f4f4de72f24c59191298d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-602 Malicious code in openbet-access-controller (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dd796ac609bd9ccd763f039c5ecfd7fd63b7c76170f3feaba70a4d2148fa881 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11737 Malicious code in urlcon (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-8405 Malicious code in @diotoborg/libero-debitis-possimus (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3962d51f7dd049fb20be0c78ca98fa5523c78987020230d2704c70bdc118e4c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-1572 Malicious code in asf-renderer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df408055de1ea1703a4d69234f7368c69466b2b470ce427a528fbe996a3f1e08 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-1060 Malicious code in unity-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d000b4d34f837a9755c05f72318c44ba0f8cf265e46224607cedae43aea73ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-97 Malicious code in wdpr-node-logasaurus (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6c7947b6bb90bbb45f4e2182f1c80eafaf6c1812c4afc92392e000b73fdc8e8e The OpenSSF Package Analysis project identified 'wdpr-node-logasaurus' @ 16.0.2 npm as malicious. It is considered malicious because: - The...
MAL-2023-8521 Malicious code in bds-ng (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb86d6e10a764d9de055f1e941aaabd3c07c262bd4182f27d8258212ed8c0169 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8514 Malicious code in frontend-style-janus (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2950942ff85300d3cee0a0eed9f373eaaa043ef93e942089421c5a5586e209e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8503 Malicious code in @atea/common-design-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2329fd9b04f0c2f8d8db0bf754737afd91b53c559c6dfa3aaf3c1f337323f9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8469 Malicious code in react-18-viem (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ab3496e80f456724e73563a2fef64ff6928d569e6e730832dd7de084aa0b3655 The OpenSSF Package Analysis project identified 'react-18-viem' @ 0.1.1 npm as malicious. It is considered malicious because: - The package...
MAL-2023-8415 Malicious code in bonded-stablecoin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5783c50f1b49753de6ebb992bb15ea3197c4db4138fa711bbd25cd125199963 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8395 Malicious code in billing.api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 507cfdb034cfdde119a280e16b6ad66952ff26fd821fd25ec866bf04f29398f1 The OpenSSF Package Analysis project identified 'billing.api' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2023-8100 Malicious code in healthbridge-design-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8a45a21805510c3390a5789a690b22ba697abed37486f11b580a61895f01ab42 The OpenSSF Package Analysis project identified 'healthbridge-design-system' @ 1.0.0 npm as malicious. It is considered malicious because: - The...
MAL-2026-16224 Malicious code in process-mite (npm)
This package is part of a malicious npm campaign published by the max233 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and...