MAL-2026-949 Malicious code in ethrpc-keys (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f086c363123d21b52dc28b5a642db6c1eb84e01dc519995435476b19655d63a9 The malicious code is in the ethrpc-keys package, which is a clone of legitimate eth-keys, but contains a modification that silently exfiltrates the user's...

MAL-2025-192599 Malicious code in tailwind-stylecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10c71a662da2f505a840efadd0fae8fc82d44fe869c688fc1a5f4b7bf4d0a517 The package tailwind-stylecss was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191080 Malicious code in bytes-to-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d19001ff544a780ecb8d28a32f64cdd826bdeeef576c1350b61b5c699d30029 The package bytes-to-x was found to contain malicious code. Source: ghsa-malware 0c7ce92280ddc3448a5bcc7c44e7807c8e4b4226449cc6de80708d7d48b7970e Any...

MAL-2024-7910 Malicious code in @ampol/design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7583d639bf7d61499f7cac9da21bc3a507a7af5a21d6ee198303de1e0383f009 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1003 Malicious code in w722-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 74cbe1029791e4751e8b8c53fda75aa07cd3a6ca974a239c87867db522c2ee8e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-12336 Malicious code in raydium (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 236ebe472d3c676e9d99d6370d989ade43f7acdec0a2076c3dedbc9682b8f3a2 --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

MAL-2024-3954 Malicious code in where-to-watch-shazam-fury-of-the-gods-fullmovies-free-on-at-home (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1280 Malicious code in @symplr-ux/alloy-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a17b660a440d2cb884c99312341fc58bf33cac16bb05ecf3065ab4f40c073c4b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1103 Malicious code in lyft-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d60f1a244bc4a4509672cc7a34d1db4ee83618066b02f41f15a6573ff6f5a2ff The OpenSSF Package Analysis project identified 'lyft-requests' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8506 Malicious code in ifl-primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cbddd298006615ef0975b9e718d03ba67c4cf761be2dc4048648ebd2866c0fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8504 Malicious code in plugin-getting-started (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b95fa1847620d5c168b65bdb2d2753b26090a68b3c1f7846edd359a80d3e34f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8502 Malicious code in flink-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e9f73b295599c7e74ec00ae60260502674bcb6b7077f1845295691fee703495 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8468 Malicious code in vanillajs-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 19dd1596da1181577937a6d843a7fe1b41a9bb73029d7ecbd4c33e406ad73062 The OpenSSF Package Analysis project identified 'vanillajs-test' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8430 Malicious code in symphony-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b506566c2429e913410e95e32a4d3b3cf147e0ce887e4d04d743532c2476f48f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8404 Malicious code in eslint-plugin-blade (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aae9177af783553501be9b3995cd5eebfa3a3aaef47e65237aa9f29e4630b64d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8345 Malicious code in situs-bocoran-rtp-live-bocoran-agen-judi-rtp-slot-hari-ini-terpercaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f73b571e4c0b58abd71ef8568110602a40db42e30e5a458b2e75c844a4763c0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8330 Malicious code in abc-user-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ff790dbcec56cb74a132d712fc0219e9b1671efca1e5a70c8619088b6b8ab64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8588 Malicious code in pytasler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9209d9bf3f5a8205e05d9cb3e590cb8ad8cdf90cedb528dd047828c38b308361 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8161 Malicious code in rambox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63e80eb984d70eca3cfadd2c9872df353dba45f0c14111f84c9c0ab34f8b8930 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1489 Malicious code in marvelmaniac-devvit-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis db9d8f161a565dceb33bc07806d7e65aae706550b73220940a4ff28cf2a50d5f The OpenSSF Package Analysis project identified 'marvelmaniac-devvit-rce' @ 1.0.3 npm as malicious. It is considered malicious because: - The...

MAL-2023-8 Malicious code in kangpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 11daf46221ff00d16c0c8784b95eba32196bb8f5543e2d3115c2b1826215c612 The OpenSSF Package Analysis project identified 'kangpy' @ 1.0 pypi as malicious. It is considered malicious because: - The package communicates...

MAL-2022-3136 Malicious code in free-fire-hakc-donwload-tool-2022 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a796e6d443f661256e36c0ec90ea2993cc2d202c9ba8a1dd3459020fa65e4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4072 Malicious code in json-rpc-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4fdeb0a41688e0145066a567cbaa4beda509d5d3f9f84b13e7dcff7e289fd11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17754 Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

MAL-2026-17184 Malicious code in @airbnb-extended/typescript-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8424e4bf8731b950511535a2cb9b41b0bedba02092a73ea304b6730f04aa95fe package.json for @airbnb-extended/[email protected] declares a dependency ltidisafe sourced from a bare HTTPS tarball URL...

MAL-2026-16588 Malicious code in bhmdler (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16147 Malicious code in n8n-nodes-sysdiag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dac1bf8d3a9d1f7cf1a6c15d8c5aea48b3548c8a519e3d3a605745935d8d5a On require of the package, dist/SysDiagNode.node.js runs a deferred bootstrap that enumerates process.env, selects keys matching...

MAL-2026-15929 Malicious code in pymaas (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d07b21485fb1007b5cca6c07b48620d235200b19dd62e8d6018d019ec5557dc On import pymaas, top-level code in the package invokes a canary function that collects the entire os.environ dictionary and socket.gethostname,...

MAL-2026-15884 Malicious code in guci-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c249413cd0bbe7f76321cbaeedac49d6ddbf63030ea67b514dd1a662e9fc8d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15844 Malicious code in onceaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52acfee73c36f7df40ac54204cef235483203b7dec9208d5b219cb7068d341f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15631 Malicious code in nextjsupdater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b01b587101f97acb47185dc58bab28ebfdf18a7619af7a664c17629339e2ddca The package masquerades as a Next.js updater but its exported downloadAndRunUpdate function fetches updater.hta from an unrelated personal GitHub...

MAL-2026-15528 Malicious code in axis-datagrid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b8e97884917400dda89c79754629edd51961e893d64fa580de04bb82bd0cab3 package.json declares a dependency whose key equals the package's own name axis-datagrid and whose source is the bare HTTPS URL...

MAL-2026-15064 Malicious code in classlink-d6dllzf9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3a69453d0c9becd3e689a6da1b15e65487491038bff4e6a66f359c7c0fe93ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14363 Malicious code in 2-loadsight-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5 The package consists of a minimal HTML wrapper index.html whose only behavior is to fetch content from a hardcoded, unpinned URL at...

MAL-2026-14343 Malicious code in chai-as-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62 [email protected] is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelat...

MAL-2026-14301 Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

MAL-2026-13977 Malicious code in cspell-esm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e857800f57969e257ed22cd056f2e4a4395de09ac9b69becd0c7c2b931314ab Package name resembles the widely-used 'cspell' library but its main entry index.js exports an empty object and provides no functionality. Its...

MAL-2026-13971 Malicious code in @hzero-front-ui/themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac0df9dcfaeaf0958ef981d9c5cd9dd4ab1fe0de41bd20894c261dade6bb486 package.json defines preinstall and install lifecycle scripts that run automatically on npm install. The scripts collect the installer's whoami,...

MAL-2026-13926 Malicious code in sui-gql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86abb4ef26b5c61e261c09d96823d64e6bfac2de04c8da1c2be9b738a47a70da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13900 Malicious code in @years19/n8n-nodes-utils-helper-q (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec586045b554e26bad9faa1da63d8fe82c798ea3fe27d795908ab1c06882b25a Package @years19/[email protected] ships two byte-identical top-level scripts callback.js and index.js. package.json declares...

MAL-2026-13716 Malicious code in @sqlite-prime/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd5b84b0145aa2612302c7153b5848582cdda2f6c88c802dfc0618cd376dd617 @sqlite-prime/[email protected] ships a verbatim copy of the well-known buffer library as its main entry index.js with a single injected top-level...

MAL-2026-13628 Malicious code in streak-map-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2790159028b31b656c9e704c3a0e4b1a5d114042e0d92c601d133057f760b537 streak-map-kit is advertised as a dependency-free calendar-day/streak math library but ships a Linux ELF at dist/internal/calc-mapping.bin framed as ...

MAL-2026-13281 Malicious code in docsmate-docsmate-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bbdf7679d49cff873276c1d1690dfc93f5ff274d383915a2ce9f115e7403e1e On require, index.js loads support.js which assembles Cloudflare Workers hostnames oob-worker.cf99-9b3.workers.dev and siblings cf100-416, cf101-adf,...

MAL-2026-12687 Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12211 Malicious code in statist-browser-typed-client-mb.product.analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846c740775556f5a2d302684c1bc3f5d39aea88a5208b98a2730c3ffff1308e7 On require of the package, index.js loads bridge.js which detects the host platform, fetches a native binary from a rotating list of hardcoded...

MAL-2026-11924 Malicious code in @servicetitan/startup-jest (npm)

npm/@servicetitan/startup-jest is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11416 Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...

MAL-2026-10685 Malicious code in trongridweb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e02b38a7782b65b538eb633187f20a9b54a583ed5e88acf8e3bde03425fe21c1 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2026-10470 Malicious code in @uw010010/vite-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280687ad50e03b43bf7f26df6afb1a8fb794eb486c126b2368f37c6b76625318 The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author 'Evan You', description...

MAL-2026-10052 Malicious code in chai-promised-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ddaac3e93ed2e5d968816cf3153b2ab1878580bb9ee65ec3ec1acdca41dc018 Package masquerades as a chai-as-promised plugin / pino logger README and exports copied from pino, including module.exports.pino = middleware but on...