MAL-2024-10104 Malicious code in phantomdecoderss (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-10161 Malicious code in sol-structs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6d466f5d94859498aa97e45fc82060c447a3004b4ea16e620a3fcc58ed8cfb3e --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: spl-types-rentry-2024-07 Reasons based on the campaign: -...

MAL-2024-151 Malicious code in california-state-web-template-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 91a0432190eb409c84a7c6bf3c06b34d9b7c4571be93f31b3635a925f4a4099e The OpenSSF Package Analysis project identified 'california-state-web-template-react' @ 9.2.1 npm as malicious. It is considered malicious...

MAL-2023-8563 Malicious code in azureml-contrib-daskonbatch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fbb97c227c663215810abd8867643e6709416bf4e16526391cc0c740f9dce047 The OpenSSF Package Analysis project identified 'azureml-contrib-daskonbatch' @ 1.0.0 pypi as malicious. It is considered malicious because: - T...

MAL-2023-8533 Malicious code in xpub-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc3e9ded369fe8fed74a7f23ab0c33cbbda2a1e16aab8c2283faba59903c49d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8579 Malicious code in pykooler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 62467741e97dcaabf79c3644575f93878d1abbf8757c6b67610de40e566ccd4f Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-8118 Malicious code in subspace-relayer-front-end (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5ba5c7d050a216acda3025b0567509efd95f5e86479d47815a1b37ee74553dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1561 Malicious code in cncf-interactive-landscape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d2b9d2c5124b5a628ea48abf890a34baae186cb6a3844fc2617ad57b21be8d9 The OpenSSF Package Analysis project identified 'cncf-interactive-landscape' @ 1.0.6 npm as malicious. It is considered malicious because: - The...

MAL-2023-1499 Malicious code in jscrambler-dashboard-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a31aff9b73f313c920ebbb6370e3afc3139565f139114ab47ef7859e989f418 The OpenSSF Package Analysis project identified 'jscrambler-dashboard-components' @ 9.9.9 npm as malicious. It is considered malicious because: ...

MAL-2023-8582 Malicious code in pyminor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f4b65ae360c6ccb0733894c0d6db59f44827dad1169ff36141aa391ef89f51a0 Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-1436 Malicious code in puppet-module-posix-system-r3.2 (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 835ce606cd37fa823a80a445ab30dce0ec0005af3a78f9ed7a8d35d63db99474 The OpenSSF Package Analysis project identified 'puppet-module-posix-system-r3.2' @ 1.0.0 rubygems as malicious. It is considered malicious...

MAL-2022-1375 Malicious code in azure-search-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 593f8130bfe080437256f79540f957cb19721fc1caa66b41f5874e0f0fbcc80d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17283 Malicious code in @xoxo-momo/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4beaa614870c21deb99c9648ae58f4ecf9fa21c22acc1b362ac50b477cd6232 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17294 Malicious code in react-nodejs (npm)

The package react-nodejs impersonates the legitimate 'react' package it republishes react's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17208 Malicious code in riot-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b944a9e85b91a70a2c0f84390f4537b2b1babed308cb23c165bf61bc20a91769 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17170 Malicious code in agency-test-exercise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43eddaf152e2aa60b9f823513a2d9b11fc424a5cff4bb3c031f6823a48dc2f4e package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The shipped 4444.vbs contains a 660-entry base...

MAL-2026-16020 Malicious code in @aircanada/navigation-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78d6c89dae0e934ca5564921316f878b55ca1e3fb9bdfebbc8a04e07708de03c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16035 Malicious code in oscar-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c988ef2dab3264cefcab98e4aae196d6c45b5555b22641e5862d89bde83815b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15637 Malicious code in test__123q1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac33922c804a14a307d55fb3dc80531482503bee2c96cc7fa4a487101c70e7d6 The package declares a postinstall hook node dist/script.js while its declared main entry dist/index.js is an inert 105-byte stub, so the entire...

MAL-2026-15603 Malicious code in pyservercheck (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10f01e2954dde5faac23074d02bb989f22d0dcb78be82c1c4417531fef8b859 The package ships a bundled Node script pyservercheck/js/main.js whose visible top half is a healthcheck stub matching the README, followed by a long...

MAL-2026-15591 Malicious code in cre-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcc14c964a76dde24165930e971dac9a2a9f36ecae68d596c7bf920cac8e1c29 bin/cli.js collects the current user whoami/os.userInfo, os.hostname, and os.platform and POSTs them, along with URL query parameters carrying the sa...

MAL-2026-15577 Malicious code in auth-app-streamlit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9662b50ee4db956c8a7ec0bd4e1c9842f709ab2d5d181c325702c727e9e8a199 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-15566 Malicious code in flask-header-guard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5e0cbaefa0fcface340b03a236573ed70df9b4d7773715321df057a9862e3f8 The package is presented as Flask security-headers middleware but ships a hostile payload wired to fire at install time and again whenever the librar...

MAL-2026-14593 Malicious code in 3layerdipstack0dsxsc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2643a6598b1615516404fd1c24e6bf45adf0b325f211259b80191f7858c72ea6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15444 Malicious code in secure-test-browser-vf21r2kh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd26dc3111f48147dd8c89c7979e6b925422609e67ced1b72952c7892f98ed66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15716 Malicious code in mega-pro-kit (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-14154 Malicious code in typesript-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac32bb6c3db806740bda125cf58a8f348256baa021b0a6c7b901ebb86720505 Package name is a one-character typosquat of the widely-used 'typescript' family. On npm install, scripts/postinstall.js XOR-decodes key 'stf2026' a...

MAL-2026-14133 Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

MAL-2026-14056 Malicious code in gunzip-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d410844f9db44f33c2f674456c727d4c46402ad8f4de02a036fec3b099b2737b [email protected] is a near-empty npm package typosquat of the well-known gunzip-maybe / gunzip family whose package.json declares its sole dependency...

MAL-2026-13887 Malicious code in @years19/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72cc0c6234ca588b2b29bf75b0f90ba24b6152f379034bb60f1956e48c6e09f7 The package presents itself as an n8n community node n8n-nodes-utils-helper-d but its actual on-install behavior is unrelated to workflow automation...

MAL-2026-13689 Malicious code in @noobaihome/amis-simple-area-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642f206459c4677892954c26736b990c72bb01ae9383f917ab664b38d977819f @noobaihome/[email protected] advertises an AI Suda amis area-chart widget, but dist/renderer.umd.js and dist/plugin.umd.js are empty stu...

MAL-2026-13633 Malicious code in modern-localization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5 On server-side require of modern-localization, the package's main entry runs a top-level async IIFE syncLanguageSystem that performs an HTTP GET...

MAL-2026-13608 Malicious code in @vertexa/prisma-fetch-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af31d3f7a70c62590a05ef03453c16828fa36dd8f3887608cc1f0655bea9b4db Package is published under the @vertexa scope but brands itself as @prisma/fetch-engine: README titled ' @prisma/fetch-engine', author 'Tim Suchanek ...

MAL-2026-13495 Malicious code in blekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020 blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module consoleApp/initializeLogger/getCurrentStatus from...

MAL-2026-13492 Malicious code in rdfxvela-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef19b46ba2f8a9d7a30bedb44d2e45903d5e4e905d736b5ce5c20cbb0b77be12 The package contains 4 files and no static or traced findings indicate credential access, network exfiltration, install-time code fetch and execution...

MAL-2026-13444 Malicious code in dpdgroup-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30c55e6b20286d3fc29d7c3bc24932180a5e94a6fe5147393d91da212fc0dc10 package.json declares both preinstall and postinstall lifecycle hooks that run node setup.js on every npm install. setup.js reads the installer's...

MAL-2026-13426 Malicious code in xayoub-xctxteam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e150a2084afb57b865384c624d91da477fe2a6ac09e84640a4f831a4a9b48a56 On import xAyOuBXcTxTeaM, init.py automatically starts a Flask HTTP server bound to 0.0.0.0:50019 exposing /spam?uid=, /stop, and /status endpoints...

MAL-2026-13398 Malicious code in @xiaohhhh1/canvas-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...

MAL-2026-13386 Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...

MAL-2026-13383 Malicious code in svelte-mapped-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 666d747ec06fa428dfb0f21867e6001b52450fee1770061dcd9bd0ec9e3731fa [email protected] shows no evidence of credential access, install-time or import-time code execution from remote sources, silent relay of...

MAL-2026-13258 Malicious code in bitcoinjs-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, usernam...

MAL-2026-13214 Malicious code in @zzzcrypto/solana-spl-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ceac45508e2f9506a082b2195d3bae4b046f096d11856d72ea53f784ad5992e @zzzcrypto/[email protected] is a typosquat/impersonation of @solana/spl-token README self-describes as a 'drop-in replacement'; author metadata...

MAL-2026-13301 Malicious code in dolyame-boxy-desktop-bnpl-card-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e20a9180ff2928b0498496b59c96983db044063b8db7c5e258b6518d5daf00a On require of this package, index.js loads bridge.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12833 Malicious code in bigops-api-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41f35d0e9c1c32b6937135731889f5494483108bf0cf449fc19e5b4cecc4a002 On require of bigops-api-customer, index.js loads compat.js which downloads an OS-specific native binary from obfuscated Cloudflare Workers hosts...

MAL-2026-12831 Malicious code in bigops-alerts-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1ece35b981e6725d807e3bfe7da2bc7e2129bb49fa6f656866ace6f67079284 On require of bigops-alerts-widget, vendor.js selects a payload path based on process.platform and process.arch, downloads an opaque binary from one ...

MAL-2026-12835 Malicious code in bigops-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80be948322937758b568e63d82d769aa07a443a3b849cf19fd440ed5bf4505ec On require'bigops-tasks', index.js side-effect loads vendor.js which downloads a platform-specific native binary from string-fragment-obfuscated...

MAL-2026-12825 Malicious code in beaver-ui-split-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9758e9a6587fb3c1314e69b881d33a634fb0255cf6bdd3540ab74a533aacc1 On require'beaver-ui-split-view', index.js loads bootstrap.js, which selects an OS/arch-specific asset and fetches an opaque binary over HTTPS from...

MAL-2026-13102 Malicious code in bpm-foundation-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab55e2c548d901242988887cc62d1a4d62ddce598f5cddb7751538d815076c5 On require, index.js loads polyfill.js which performs an https.get to hardcoded Cloudflare Workers hostnames assembled by joining string fragments...

MAL-2026-13108 Malicious code in bpm-foundation-date-range (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fac5d5e2ebbf743977ac3ac1149da83ee41c1b7b98b10e97619e83fd3a18550c Requiring the package's main entry triggers polyfill.js, which selects a platform-specific endpoint and downloads a native binary over HTTPS from...

MAL-2026-13113 Malicious code in bpm-foundation-nest-keycloak-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6028d40d9f000e522af8bd82686a497d07e5496431bf43fc49161f8b31ac3955 On require of the package, index.js loads shim.js which detects OS and architecture, then downloads a platform-specific binary from Cloudflare Worker...