MAL-2026-14114 Malicious code in userbotjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0afcc62f361549813f605462124928c14c5228ba1d87e19adea38cc5e13c3609 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

MAL-2025-6361 Malicious code in exceljs-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 542e79c60c18aa779332620c884952b318f885c798a0ac8c2d3bf87bfad26950 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-275 Malicious code in @flameshot/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8bbca4a9cd0a35a35928860188f38aa877f6edfa6b4eb2b65c110d2d83990bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13790 Malicious code in bvdfhdfvnk3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fadba2f2b2bb1c3507b2559209c50677db3b20feb0c083333567dfe7fcbddc4 The tarball contains a single index.html declared as the package main, with no JavaScript entrypoint and no preinstall/install/postinstall/prepare...

MAL-2026-5235 Malicious code in awaitly-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3f926748b1e107755cfd17cb9151edc730b0228b6e857735a6794f8c1e71c65 No concrete indicators of installer-side harm were identified in this package version. No lifecycle hooks fetching remote payloads, no credential-pat...

MAL-2024-4544 Malicious code in MetаMаsk.Blazor (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2022-2913 Malicious code in example-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67077359006aa50f08c2757c83cc757f06c0b0817b3beb029ce4f6e823236c03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10528 Malicious code in @vitets/vite-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf Package is published as @vitets/vite-ts and copies the legitimate Vite project's author Evan You, README, homepage vitejs.dev, and repository...

MAL-2022-2047 Malicious code in com.outsystems.plugins.fileviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68e48c3e2dce6b01b3a80e3284dea055908e7c232a4f9fa11407fd851f4c0ecc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11524 Malicious code in keyv (npm)

npm/keyv version 6.0.0 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

MAL-2026-10758 Malicious code in mfq-private-encoder (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f2c0f78a3c5677481645e05e125f32273435610a1208a17ca4f852cb7f56b0e The package advertises a Python source-code encoder but has no local codec. The encodefile function and public encode API read the user-supplied Pyth...

MAL-2022-6974 Malicious code in vscode-clangd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3e05ac1fabef54ef34176e9d555cb6e63b3dfbc2241cf304ab6a1b8b3cd2cc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10601 Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-4301 Malicious code in auth0-android-helper-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bbf606b203b722af6caf26888ddc7c9bb9c1bc4117d52c963615a998b3bf933 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6210 Malicious code in @apexcraft/nano-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c46938b3634fb4de89ddf44b765e1c766c871a40fb31c54609c1b3526074e65c @apexcraft/nano-key advertises itself as a 12-byte sortable ID generator README and repository metadata are copied from yiwen-ai/xid-ts, an unrelated...

MAL-2022-6354 Malicious code in superset-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71368c8e29fe057fcc95335932ec6248b0a21541c5be1c4f54aa8fa03167a152 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10726 Malicious code in astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c This tarball is published as [email protected] but does not match the legitimate withastro/astro project which is on the v5.x line and depends on picocolor...

MAL-2026-6760 Malicious code in @adobesign/as-dev-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6752e4d30c584cb5ca6f67265c983257c1531aa306b47ec00b43ddae83fe2532 The package's package.json declares a postinstall lifecycle hook that pipes the output of whoami through curl to a hardcoded Burp Collaborator...

MAL-2026-5737 Malicious code in postcss-minify-selector-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957f5cbb74f4dd4b4770e8c9cc1a8aac88a4450cb01dbc0fa5242c42e343f54c The package name impersonates the widely-used postcss-selector-parser library which it also declares as a dependency and re-exports verbatim from...

MAL-2026-2688 Malicious code in @pnc-cib/cib-core-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8766c693609e1190061234006c3ba48a9e4f421805daabf59baa712e6d634eee The package @pnc-cib/cib-core-lib was found to contain malicious code. Source: ghsa-malware...

MAL-2026-14229 Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

MAL-2026-4136 Malicious code in jest-canvas-mock (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2024-4924 Malicious code in coloramas (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10452 Malicious code in markdown-editable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b15669732f3eaec42e12c5f8d41a8f74d595fc04f709804de9768cb1719a94 The package's package.json declares a preinstall hook node index.d.js that runs automatically on npm install. The script in index.d.js base64-decodes...

MAL-2026-5315 Malicious code in ensmallen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a05cd4ff9f8142405c5672f1ffa54d575165f6bc2b0f5324c9bfacf75e651de8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-217 Malicious code in experimental-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 946fb0e9d7a8c7da433d27ef4005111b34c3e75f8827686d43696855315d5867 The package experimental-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2023-1011 Malicious code in docusaurus-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 051d35253b6ae2ef5d7366a3879b1783f91c35cc5fa1346198db3d6326e0e589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5209 Malicious code in @vapi-ai/server-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67e1edd9922bb8b3962aad95b2bb1bfa39c3ec47651fe4863035111fc292dcfe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2024-6694 Malicious code in assembla-cli (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5024 Malicious code in cxcxcx (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-13798 Malicious code in cvjwyinkpas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d08c8385d108f4de0a3dbdfc01cfce3fc5322a875b05a04bb59a3936b653cb05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6309 Malicious code in @nullzero/urlcat (npm)

@nullzero/urlcat version 1.4.2, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern [email protected], with...

MAL-2026-5478 Malicious code in mcp-server-git (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cf54d60f4aeb261f3b4c523293183b728b02bc20255aeab62d7f86c94adc7ed package.json declares postinstall: node index.js. On every npm install, index.js lines 14-29 reads os.hostname, process.cwd, os.platform, the npm...

MAL-2026-6592 Malicious code in maplibre-gl-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a46347c152553bd008255683dd927e5f25233224d3c6f1df6ae87533350b5815 The package advertises itself as MapLibre GL bindings for Vue 3 and re-exports the upstream maplibre-gl API, but on import it unconditionally injects...

MAL-2026-5476 Malicious code in mcp-server-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34dfb6dc382073bace8a4d413b28000ff42770d04b9f69a88906230e2d83260a Package squats the unscoped name mcp-server-fetch an MCP server name commonly invoked via npx mcp-server-fetch by AI coding agents and developer...

MAL-2026-15605 Malicious code in m2fcsfyjkuxb (npm)

Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...

MAL-2026-11559 Malicious code in @cacheable/net (npm)

npm/@cacheable/net version 2.1.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-6355 Malicious code in ppt-creator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8040bc58597dee52581beb232688c85302554af0af5726abc15c56a21ac69f2c On npm install, package.json's preinstall hook runs index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, dirname...

MAL-2025-7121 Malicious code in @bmw-ds/components (npm)

The package @bmw-ds/components was found to contain malicious code...

MAL-2026-15820 Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

MAL-2026-15721 Malicious code in mega-safe-pkg (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10805 Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-2-0-uk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b696f700f27e6f4b535ddb3bd94693d82151e3264fd6813b075872a5caa2c0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6820 Malicious code in express-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32d2aa353711781fe6c36cdd812494ae741f85925d1bebdb2a21532dee6800cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-191211 Malicious code in @dev-blinq/blinqioclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a1d417e283165e25dc75c9510f4bcdde80854ca5600090b4de220548e72ae1 The package @dev-blinq/blinqioclient was found to contain malicious code. Source: google-open-source-security...

MAL-2026-15728 Malicious code in micro-fast-mod (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-14039 Malicious code in @cdnshell/loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b572368b522527a308a0a8057b3b0945ded5c73f4dcad6ab738eaa2b7ddf6e3 Package presents itself as a CDN static-asset distribution library but ships 19 pre-compiled arm64 Mach-O binaries under 03payloads/ stager, kbridge,...

MAL-2026-5963 Malicious code in @mastra/schema-compat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3037c66f9c4357ce9a1c2ec848e86eeef189f1b1a2c3f9f6c891963cf60049c0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2025-189 Malicious code in flutter_inappwebview (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 394e259ceac6eb2a72e92a5882933facc39e1ad19e0bf1a6b908a92ce115a28f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15576 Malicious code in quesoeducation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c428c1658948c78d2e7323de16bf1f37dced0bcd770cd73fd2b3c0855f6aa7b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...