239548 matches found
MAL-2026-38 Malicious code in auohttp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f4b76a407d91e23cb990d6ed08e3c0e81898f2b97d690db76b4e3b547fda5fab Obfuscated code downloads an encrypted binary blob, which is malware finally starting cryptomining. After starting the malware, the Python package uninstall...
MAL-2026-8 Malicious code in @nitaiapiiro/rand_emoji (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 686999eb6a9720383d59bbca502497c33b67e49cd4f21b0fd3eba33d9be8aefe The package @nitaiapiiro/randemoji was found to contain malicious code...
MAL-2025-191702 Malicious code in chromifypro (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4138883ad2e38b4a8a4353918126f4732db5f04107be0bddafc745ec97120b52 Packages silently decrypt content hidden in a dependency and load them as Python extension modules. In the first wave, those are copies of legitimate aiohttp a...
MAL-2025-6692 Malicious code in aiohappyeyeballs (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2059da56cd060292843a9bf0b02a2c41b90d84e83b5b15aa59580a8bc9084a23 The OpenSSF Package Analysis project identified 'aiohappyeyeballs' @...
MAL-2025-191943 Malicious code in zmaker (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2f4ac88a121488df2fdfa1cb5409f3443f658a30d679f20acc41dd2c656bd3b8 Campaign is split into multiple packages that altogether exfiltrates data from desktop Telegram application. 1. "pyapiepo" is a cover package that provides som...
MAL-2025-2599 Malicious code in bsb-family-bot (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron 73381c6a90c69556e5d81fd8b66b24eb30907c18f1b24a8a1de3635d533d3284 This package decodes and executes a script during installation to set up a Telegram bot for device event monitoring. However, the code is...
MAL-2025-73 Malicious code in utf-cleaner (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 09b9e5c5deafbf756df5201976fdbdc3c61c10e815234df9aeb32764a3cd9652 During import, the package silently downloads and executes remote code. This code starts a web server in the separate process and listens for commands to execu...
MAL-2024-11182 Malicious code in @0xengine/xmlrpc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e8df33e10862a6cfd274bd8eae46b471dd53dbe1c3885b47a379b2f790898f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11640 Malicious code in mumuplayer12 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f5e7ec41057042474a89cfaa47532d1f790110bc7ac08533ff4dbeea9ee91899 Importing a module starts downloading and executing an infostealer, widely identified by AV/sandboxes. --- Category: MALICIOUS - The campaign has clearly...
MAL-2024-6938 Malicious code in hack-cards (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-3895 Malicious code in watch-now-shazam-fury-of-the-gods-2023-full-online-free-streaming-at-home (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-1586 Malicious code in addthis-wordpress-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6d8ae72ce3501b8463193222bf9bebe2913ee52bf39fb10c8c9aa2f2049ebaa5 The OpenSSF Package Analysis project identified 'addthis-wordpress-plugin' @ 2.0.0 npm as malicious. It is considered malicious because: - The...
MAL-2024-1019 Malicious code in eslint-plugin-unicorn-ts-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b71b5afde24f585fa4738155252aed586c08f3603e822cf5a6ce4b67e2df87fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-620 Malicious code in wlwz-2312-5000 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0434173cb65699bd45454f80e823d04cf650a8946ac127a143ffa8bed2832c0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8433 Malicious code in stripe-terminal-react-native-dev-app (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 148f318d6453b35d5563824a26fe185c3df7e96f1a4f12089adbbb556e867459 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8417 Malicious code in transaction-decoder (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 588e3ae64f6791e490455f6c01512f655440e86bb808155dc3a0ece45f77b016 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8314 Malicious code in data-layer-v8 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e4c8f846b0ddb1097d47c477e40c0ce16ee83df9e0e4d2ad331a6f638a0c0e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8305 Malicious code in liblapack3 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74012077041418bce1aed1339b95d0221435cff33db310194f29d9a0c2451e6e The OpenSSF Package Analysis project identified 'liblapack3' @ 0.0.2 pypi as malicious. It is considered malicious because: - The package...
MAL-2023-8303 Malicious code in rocketmoney (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c74848dd285d1b4df9e891b6a02c21b1167ee60909824af678d6f7cd57d8ae0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8583 Malicious code in pyowler (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9df2ac0489cd9816fc13f309f73773ae3fc26794b44dd4930ab92a367115899f Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...
MAL-2023-1508 Malicious code in auth0-playground (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4267198f7d6d37ea13e1bdc92116960ceef69ae0ac639131ebf85d223180dd22 The OpenSSF Package Analysis project identified 'auth0-playground' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2023-1467 Malicious code in ynf-dx-scripts (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6dfe1e0b8085faef3ed0105448c3cc1d7f7bba72ab13023a2eb5ba38827da39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-1250 Malicious code in noblox.js-ssh (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54d256313b540a1d57c4e1113c411f1a40210f65c3737a5f68ea3b324e23b054 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-1031 Malicious code in command-launcher (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a7b891d069224249cbc33b96113ab88f41f6eb292cb9a94e8232641a2e2ddf9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-74 Malicious code in @zola-helpers/client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee698d441406b57b08f773d9f7c97565c0d839bc65054354c7ab8f4556b4293a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3993 Malicious code in ivalua (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e49b3611b92651d0d63b25ef21315b047126b31c26f75dc99207192627279e78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5528 Malicious code in purple_team_midway_teste_cenario_1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0da74d83112d47ea6bda3eedd0cb4f78fb0fd300a9e57fc9bb567c4e97e8c320 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5679 Malicious code in react-trfq (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5d584711abed8ebfeb8c32cd0041a8aa745a647714b1bc533e53f937bf884b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17173 Malicious code in chromatitle (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793cf7eb2b4de9c41e229fc89c393e38f05141991762f69f310e1397fa464f9c chromatitle advertises itself as an ANSI color/title formatting library but its main entry src/index.js unconditionally calls bootstrap at top level,...
MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15635 Malicious code in tailwind-modernanimation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an evalatob'...' call at module top level after the plugin...
MAL-2026-15614 Malicious code in ndmfguyhoxc3 (npm)
Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...
MAL-2026-14401 Malicious code in multyproccess (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7938a109a642dfe8b161e9568d6373a038c3413c0fd1f2b01702f4f173348553 The package's setup.py overrides the install and develop cmdclass to base64-decode a bundled request/.payload file and launch it via...
MAL-2026-14348 Malicious code in moidevy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664 main.js imports childprocess and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal referenced at lines 358 and 452, with...
MAL-2026-14083 Malicious code in heft-storybook-v6-react-tutorial-storykit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5955868f72344703128add3301e3a85b51773de502f24e636fe0b9bba86d42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-13892 Malicious code in @years19/n8n-nodes-utils-helper-i (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f484be79b89b443e145029a177ed84e3d55653a6ab1d0f62cec1df2eff70c44 The package's postinstall script executes callback.js, which downloads four tarballs mhddos, pyroxy-full, impacket, multidict from...
MAL-2026-13490 Malicious code in fast-hashes (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503b750458783954b66f8dea6ee8b0300fd7db5b225280f1af432cf78c1faf6d setup.py defines a custom install command NativeInstall.run that decodes a base64 blob and passes it to execcompile... at install time. The decoded...
MAL-2026-13459 Malicious code in streak-map-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...
MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...
MAL-2026-13402 Malicious code in jagproject (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...
MAL-2026-13269 Malicious code in devplatform-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...
MAL-2026-13278 Malicious code in dlp-dlp-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...
MAL-2026-13314 Malicious code in dolyame-boxy-independent-bnpl-cards (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...
MAL-2026-12830 Malicious code in bigops-activity-headers-interceptor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 276084c74a91d1e2369091a4da29068c4c3c46b3e1cc782a2fcbbf1d4261e9ec On require'bigops-activity-headers-interceptor', index.js loads helpers.js which auto-invokes start. The module fetches a platform-specific binary fr...
MAL-2026-12838 Malicious code in bigops-tcrm-identity-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183fa24523e19286718ff854ed8d080c8d8635d6d914a3fbb871c388660fc479 [email protected] is a dropper disguised as a session-management utility. Its main entry index.js requires bootstrap.js on load, which...
MAL-2026-12848 Malicious code in bigops-tslint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6335298379affbc02ca5288e29777324f4d13ddec51b21ce999bb6eeda3996f The package advertises itself as a lint tool but its index.js unconditionally requires./ext, which on load selects a platform-specific payload path,...
MAL-2026-13107 Malicious code in bpm-foundation-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91 On require'bpm-foundation-common', index.js loads loader.js which assembles C2 hostnames via runtime string-joining e.g...
MAL-2026-12684 Malicious code in delivery-ci-unit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ab1e8e2553a7469b1ce9a50549b0f1cb964160096693715d10643a853eade4 On require of the package, index.js loads loader.js, which reconstructs attacker-controlled hostnames from split-string fragments...
MAL-2026-12219 Malicious code in tailwind-animationgroup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7ac62a4a5dbe9acfdc813215213c698a79588f96614191505e41bf116c9c66 src/index.js appends an evalatob... blob after the tailwind plugin export. On any require/import of the package, the decoded loader queries Ethereum...
MAL-2026-11526 Malicious code in nagix-nodejs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279 package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines in index.js. The first...