MAL-2026-1677 Malicious code in chai-cli-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9f4be84db26d0ce71d5bcfda424b1af08abddc37c23d3a2ef2b4263534fde2 The package chai-cli-async was found to contain malicious code...

MAL-2026-1264 Malicious code in python-requirements (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 40fa77c47c3649fce85f601f8aa10bf13674e5db4a2d35f125cb48b77d65f99d The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current...

MAL-2026-979 Malicious code in home-robot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f5296b22d674fc768fb08662c83b8de3fd07455f6fc2d4f7b433319551cb808e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-201 Malicious code in wac-react-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3574245c1ec6c0d46b337b9600a38046ef129489605e5e108fcaaed753d50c9 The package wac-react-dom was found to contain malicious code. Source: ghsa-malware 483203b2478e5e472201a6f6d8efef0353ca7fb2ccf429996cc59e2574b2e497...

MAL-2025-192435 Malicious code in loguru-utf8 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e20933ac001bbe12fd7962f9e12208f3224c836f3deba7669a649165232e0b78 Package clones a popular package loguru, jsonschema, .... While it claims to have some additional features, the real change is an added compiled native library...

MAL-2025-191478 Malicious code in bitcoin-lib-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 480dbd7d7ec801a0212ee78ebb73268cd67ba4fb96b06ec563fbafe31aa10531 The package bitcoin-lib-js was found to contain malicious code. Source: ghsa-malware 95f79207062e8c5db317d3487c20f36927b99e9f0b9bfc2551c22a23d10c020f...

MAL-2025-191213 Malicious code in @dev-blinq/cucumber_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db4a451970465311f6a1d2b9ac8b4713f2f4ff114aa37c12dd0daff6032c8ab6 The package @dev-blinq/cucumberclient was found to contain malicious code. Source: ghsa-malware...

MAL-2025-187881 Malicious code in luna-xanadu-aquarius-barnard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbc41d7b808faaf60c42dff26f6f47331e3bd6a23a51389d3ae2a88c7c0f9c7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113880 Malicious code in fajar-ruwet2-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93bfc4097f35150abe451d0b8479f1b04eef6be598f889a5d94a1c564ec2b90 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-41268 Malicious code in api-react125 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d2f6ad3f3d48477a940b0ade2ae623d9001486fb2dee5c4f448fa429a9165879 The OpenSSF Package Analysis project identified 'api-react125' @ 99.0.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-4092 Malicious code in keypair-encrypt-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a2d0ae49bf40dbf55ae8f036a2014dccfa4ad0194cebdc787acbfb69658df40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3176 Malicious code in @n37scancp/highlight.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 944af106fc0b2a334ed1ab4fb6784a0b2cc01e5f795b1de3449b8deaf6560b50 The OpenSSF Package Analysis project identified '@n37scancp/highlight.js' @ 11.11.12 npm as malicious. It is considered malicious because: - The...

MAL-2024-10573 Malicious code in fabrice (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security d1d6b36980b1999e5525b7490b4a430c21cb4f86493a11b76f34ae8c02bfc19c The PyPI package fabrice is a malicious package typosquatting the legitimate package fabric. The package is an info stealer primarily...

MAL-2024-10727 Malicious code in huggingface-hubs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d238b4266e7eb2a0fbda69d410f875e0625c30fcf79647d89c6e3358cbdcb55 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-6569 Malicious code in alipay-escrow (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1163 Malicious code in paysafe-gpf-as-communication-lib-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 997f87146bcd457b4e2cb94ddbcfbb3730c96dd9a2b5843fcabcbb9456cf899d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8531 Malicious code in vpc-nat-gateway-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9417e9eb52b089fd432e5dd38464df3ef02177d6b0d26f9fc664ef56591c4ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8527 Malicious code in jerrytestjerry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afcd6612db745033b56fd846df2a95e2611a705900675bdd152150c2518fc2ed The OpenSSF Package Analysis project identified 'jerrytestjerry' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8470 Malicious code in jest-coverage-report-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a570942cc8be879311bbb1b601f658554c30fa3734aacac08c1c53289da55bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8440 Malicious code in mux-meet-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a7f1d733a701939944e87966e022ec92915cd460d6293ee215e0e838ce752e77 The OpenSSF Package Analysis project identified 'mux-meet-nextjs' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8435 Malicious code in tvaultuiv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5ffe7dc0907e6c0a6e1fc443558d8a6117e991d3b392e45eded0a16a22388fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8304 Malicious code in libblas3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ce6c63048cc523093131cc1ce9bdc1581093b52f97225581ea78fef61404e8a The OpenSSF Package Analysis project identified 'libblas3' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1492 Malicious code in github-deployment-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fbecfc86b0734310a1e38d002a298fffa75da0631b0309309bd26ad98188e97a The OpenSSF Package Analysis project identified 'github-deployment-action' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2023-1474 Malicious code in infima-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcc026f6dfc120957923bfddc830c588da513981ea2aed8e761a04719a8454bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1130 Malicious code in cdp-ops--ts-accesslog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3f91b885ec95bb15b4a6f58f71cccba8ac7528ef5c5bcae18f34f74e27f0f444 The OpenSSF Package Analysis project identified 'cdp-ops--ts-accesslog' @ 1.4.3 npm as malicious. It is considered malicious because: - The...

MAL-2022-4475 Malicious code in mapbox-studio-default-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f89940d67ecc912beb4510d0c28e80d664a00e725782dbeeb3c20882e75df42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7048 Malicious code in wavoip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 978ec410c0a4c57a05e3ebf73205f1134733f68c3c56aa50bb7f295f3e5e8c16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3081 Malicious code in flox-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 917341a203854d8c90aa87af7cc29eb5a24fbbd24c03e72cff50922ea59ade72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17252 Malicious code in @hrmony/belegerfassung-pladddform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615255a66c44204b03e60a165c1a9b21f95ecd351bf58c355462c159c74d1017 The package's main module index.js executes exfiltration logic at top level on import. It first sends a hello beacon via HTTP POST to the hardcoded...

MAL-2026-16217 Malicious code in tetotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b181542b0c55a472e316ca973cc5b1deaf31986645fd326903e8c31ab20acab6 package.json declares preinstall and postinstall lifecycle scripts that invoke wget to POST the installer's shell-expanded working directory $pwd and...

MAL-2026-16177 Malicious code in n8n-nodes-buildcheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65dcf471b1b0c1765b92cab4922777dd8486ad14cc17bcd9475996585c75eebc On npm install, postinstall.js collects the full environment, id, hostname, and /proc/1/cgroup/status into /tmp/.be and uploads it via wget --post-fi...

MAL-2026-16098 Malicious code in bq-build-probe-vrp-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46dd2007aa00f3bcd8ad6c767a4f1bf2da7ee75cf91d5b692aec39c546cc1d65 setup.py executes at pip install and collects a full dump of os.environ, hostname, uid/gid, uname output, /proc/self/cgroup, /proc/version, and the G...

MAL-2026-16083 Malicious code in @vnxsync/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c34a09a0ca8e45d167ab7b26e0b1882a8e2cabffc64495637e884258b3ea57ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15627 Malicious code in hyperliquid-composer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fb2b7d17a47aa4fcd585374f33063197f52d6ba8619e4105ae5a1d30331bb62 bin/cli.js also declared as the package main collects the installer's username via whoami / os.userInfo, plus os.hostname and platform, and POSTs the...

MAL-2026-15342 Malicious code in secure-test-browser-fl9ivf6p (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94a9e3c3b7628dd51210323c2bea2b6d11779f793fd3a57a430d3ff226077a56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15403 Malicious code in secure-test-browser-o6h9f5zo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16e15fe4df6ea59e9c45c2868c091246dabecd6274534ef34ea8c95193a79493 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15261 Malicious code in secure-test-browser-0qyw2qfc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2765f7668ac6dbb052da8326691d13b1afdd65c3483ccdd4343fb86543116d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15304 Malicious code in secure-test-browser-95spzg4v (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e94b6fc146ab19950997e8bbaf2c72f6934cb75a9d424ee2fbd53187b9c41dbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15284 Malicious code in secure-test-browser-4eirlssh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f5f70ba8dcc1b2a777d5133b3b0b7f4bcf7be0116c7290484f405235a432da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14402 Malicious code in agentgui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7712e51950473497493a076fd637f14d2ba2e5a0313e9e5556f73718b34aeba6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14337 Malicious code in internment (crates.io)

internment 0.8.7 was published to crates.io from the same maintainer account droundy as the trojanized arrayref and append-only-vec releases, which appears to be compromised. The release adds a dependency on an attacker-controlled crate whose build script downloads and executes an...

MAL-2026-14279 Malicious code in localize-translate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a4a3b42b13a5ba692edd9761c2d32d6682f555828df49cb44e40b623861a1f0 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, arch, node version, package name,...

MAL-2026-14140 Malicious code in vite-svg-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e61dd39d0c1d39a3b80b7138582b334480c2fb89e990a2b64e6c59050a998f The package's exported getPlugin/setPlugin functions decode two base64 constants svgValidateKey, svgValidatePattern at runtime. svgValidateKey decode...

MAL-2026-14111 Malicious code in sugarball-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13855 Malicious code in @years18/n8n-nodes-utils-helper-k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98b642758135082a579c323a4b208b0a3da9bf7ce06537636ab555d25f7dea69 package.json declares postinstall: node callback.js, and main points at index.js which is byte-identical to callback.js. Both files, when executed,...

MAL-2026-13282 Malicious code in dolyame-boxy-atom-bnpl-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...

MAL-2026-13324 Malicious code in dolyame-boxy-independent-bnpl-partners (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc33c2ab8bb4f548091d802fa40c836d0a2f655bde7efe2a9db2bc0c9f49287 On require of the package, index.js loads platform.js, which assembles attacker-controlled hostnames via array-split-and-join obfuscation...

MAL-2026-12812 Malicious code in ts-toolkit-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49d47be3f5dc16ea70755e0233f46106d3f50d1d5384a4f20c76b91463c9876c The package's main entry defines a getPlugin function that performs an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/112...

MAL-2026-12284 Malicious code in tinkoff-volna-zustate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01865b8f060a3e4a24f34537d14ace960460519b2e5e3073083c7de9da63bd9e On require'tinkoff-volna-zustate', index.js loads bridge.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

MAL-2026-11627 Malicious code in @onereach/salesforce-miaw-client (npm)

npm/@onereach/salesforce-miaw-client is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized an...