MAL-2025-50405 Malicious code in fajar-sambel40-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ca9c6587d4d84daa0288c9a84982392a9c855b6a8cf36859ca1f253ffe07361 The package fajar-sambel40-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-191838 Malicious code in pytelegramapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d50aff9e36f41642610a858c0117318ed7483aad0e4f517a1485ca2d66574c2a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-45402 Malicious code in oauth-standard-umbra-antares (npm)

The package oauth-standard-umbra-antares was found to contain malicious code...

MAL-2025-6593 Malicious code in spl-transpiler (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-5907 Malicious code in dark-switch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12148dc0d61c4e63738c356e019b3cc4d6ef0b5f1b23fae084daa1be5dccefd5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4938 Malicious code in husky-es (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7389701dece7abfcef40d0bfff8c26f78ce0a68100f40bff5e834bf57d6e637 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4775 Malicious code in vite-plugin-esm-federation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1f7926dff38c759aa63ad9b55035d541c0512f6796681961dcd734e4d77cacc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3269 Malicious code in vault-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c39e1eed1d8bf3442c38c8963d7e9aae31825a734eec63405aa146da7a02b57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2472 Malicious code in ramp-tax-info-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0679be505671452e55b48549ce4c786016851ea54330a9bad829775f5c786c1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-898 Malicious code in account-eth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-327 Malicious code in 1password-sdk-exapmles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98366c77213b87d7622472828c95aa7590386458d140ad0a0b31a86afde5b6ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7773 Malicious code in lllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 062d87cd9960f0320b626d6a3a1992927ccb268cab8ce435fa6e70006be525ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-6570 Malicious code in alipay-global (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6463 Malicious code in activemodel-immutable-validator (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6182 Malicious code in upgrade-requestt (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5765 Malicious code in pyqtcolor (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3615 Malicious code in updated-tricks-v-bucks-generator-free_2023-gcb8f (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2859 Malicious code in pelisplus-repelis-ver-creed-3-peliculas-completa-en-espanol-01 (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2092 Malicious code in dialog-holder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7bce8075d6c7b197200b3f0fc05f5aa1b20b23ace29604b477a33c5a8295cce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1793 Malicious code in axle-react-native-app-sync-client (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1048 Malicious code in @apics/apps-ppp-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a11545fc54b4d0cdd2e0e8de4ab835b254677aff86d325e9bec6a0a6b5e090a8 The OpenSSF Package Analysis project identified '@apics/apps-ppp-web' @ 9.39.1 npm as malicious. It is considered malicious because: - The packa...

MAL-2024-980 Malicious code in nhatcoder-fb-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 514bcd1028981b3a51b43d0f59deab5d625f73a52db290bee59c40e598bf0c86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-340 Malicious code in wlwz-2312-1808 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dddff4614123e97568be56cd8903bbfefb1aa3df8d6600287abd8cc7c803b386 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-213 Malicious code in wlwz-2312-0407 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13ddeab72fa40b5667e83a49dbb0a207c239dcc9b2b99708f0c808e0729eae30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-38 Malicious code in schedules-oauth-itwin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e21b2eda580f9d76e7aad06ba2f5736f46f61eda97d6e3426566e3e1a6b6d638 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8526 Malicious code in carvana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 954bdf3d35f93afe84019ba5192564e1e4538bac34eafa80b8b581db0a7c8d86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8519 Malicious code in oasis-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6bbbb6d6d51b6b4eae513979526b1a1d3c7c7b9947f319737a35fe899336adfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8392 Malicious code in ux-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1ed957b968f0d201b3698f9027b13297541196d608edb84f496f3262569e5a81 The OpenSSF Package Analysis project identified 'ux-website' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8374 Malicious code in by-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 020adf63230fbcb34dc4642692ba5c5a7b6df10d3210f7f53717db56ba4e98dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8355 Malicious code in alisdkcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 456242a426a17eeaca869a5f00ee2f02d837dec5bba7da9240b6bec77c0ae8a8 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8343 Malicious code in pragmaticplay-situs-slot-online-banyak-hoki-paling-terpercaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0bb9559484405e38427ba29fe4572ce1df42fa5a9932f8f785d2ed5295f3240 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8328 Malicious code in storyteq-landingspage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4afd6024868a60b4e03e019e3ffb5fd1f5d26aae904997e67ed0671c814e4850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8302 Malicious code in @siigo-arquitectura/button-atom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10fd520d1b3077c01e859228a807bb4d066d090fa3e1d1b287389a9f45d58a78 The OpenSSF Package Analysis project identified '@siigo-arquitectura/button-atom' @ 5.0.7 npm as malicious. It is considered malicious because: ...

MAL-2023-8188 Malicious code in optimize-procurement-and-inventory-with-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d4a974419b1ab87d44f6d1c5cfd7fac97f037b476328f114d344113cf6bbd6f The OpenSSF Package Analysis project identified 'optimize-procurement-and-inventory-with-ai' @ 6.1.8 npm as malicious. It is considered maliciou...

MAL-2023-8099 Malicious code in brum-global-variable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57eb73c6cef367bf2c5464967ed374a34f64862b3598ebae764c8b292f5d47e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1502 Malicious code in jscrambler-permission-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 131a72d7a509dfbdfaa80048c9ac64559b4f8ec25798e555ea15688529491856 The OpenSSF Package Analysis project identified 'jscrambler-permission-utils' @ 6.6.6 npm as malicious. It is considered malicious because: - Th...

MAL-2023-1035 Malicious code in flot-axis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75e800a2dadaa8f5d0ac8a5db1564e97a702c66176c2da0c537191d88cf8fc81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-947 Malicious code in vue-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d83b4e200320d89600b71bfb94b2106e5e01fe0c319873c9dac9b0d9661447da Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-2475 Malicious code in pyautodllxd (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f459717e35091f9518335b31c67eaf3dd9c6033679b4b24572e7f32c8669c8c9 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-1774 Malicious code in discoord-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 68df26950a7ff2b46cdf12d50fb094b9ff5f9f7020f2a3c56e945f753289057c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-34 Malicious code in @chegg/wtai-upload-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed3e4233e6f2d188d7f2bab940bf8574017cf73a97b440daddc7f4e3176075a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-405 Malicious code in @m365-admin/utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6653393ba05388becba1d5bac78a6fbdd082bfca80c30e6fd4d4639468469dd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1471 Malicious code in bats-file (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cfca84a87fa56f411667056ac2253f8ec037bf25285d30acd34fc673d29dccf9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5882 Malicious code in rxp-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58a81d26a7c02ecc5eeafca952ea66f977e87e8519addaf345e8861734824265 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1302 Malicious code in azure-communication-network-traversal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f7a0cec00dbd776206a45492d115fdad30ccb30649387fcb23e928778c431a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17650 Malicious code in tensorlake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 898b31edaabc82c76dc8d25f10ceee38c7ef51ee34887461a5bc8ce9f0378b50 The npm package [email protected] ships lib/setup.mjs as a heavily obfuscated single-line script using hex-mangled identifiers 0x15c964, 0x35672e,.....

MAL-2026-17648 Malicious code in function-flag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41710fdfae55850258c24f8be4df71e28d46d964cec0faa6def842369592ed2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17401 Malicious code in noverojs (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17240 Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

MAL-2026-16432 Malicious code in @wizloft/harness-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 328a1e142939c4523f9be9f14f94ae40f314f2c8ff7f2531e7474c02100ec523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...