MAL-2025-191916 Malicious code in unicore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0c63e3dde8ac739b216a37381f04cd29e543075af8fb347b1685daf4a84e9d6 Package is just calling home and there is no other purpose --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything th...

MAL-2025-41438 Malicious code in @nx/eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b11cb4be7497510402676b2b593e6a5d3e0dee4e1443996403e8aa496f284f3 Summary Malicious versions of the nx package, as well as some supporting plugin packages, were published to npm, containing code that scans the file...

MAL-2025-17975 Malicious code in dashboard-v3 (npm)

The package dashboard-v3 was found to contain malicious code...

MAL-2025-27038 Malicious code in mz-vue-datepicker (npm)

The package mz-vue-datepicker was found to contain malicious code...

MAL-2025-25675 Malicious code in lunar-gs6x8-5u52d-keystone-project (npm)

The package lunar-gs6x8-5u52d-keystone-project was found to contain malicious code...

MAL-2025-9145 Malicious code in @opensearch/datemath (npm)

The package @opensearch/datemath was found to contain malicious code...

MAL-2025-7063 Malicious code in @amber-team/react-event-tracking (npm)

The package @amber-team/react-event-tracking was found to contain malicious code...

MAL-2025-6130 Malicious code in spring-tx (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccb59e10d8881abf3b2dc67ba4e148293566cd2978a32ebb3f07008e91ba5952 Any computer that has this package installed or running should be considered...

MAL-2025-191877 Malicious code in spyderlib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5c8cd8b0bcebda767e6d2f280c42cfd952522e31086aa816be6b3350611874a1 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...

MAL-2025-1988 Malicious code in ransomware (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-45 Malicious code in solana-login (npm)

The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...

MAL-2024-11666 Malicious code in py-colorprinting (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-10285 Malicious code in byfron (npm)

The package contains code to download and execute an infostealer payload...

MAL-2024-10176 Malicious code in trondecoderss (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-12303 Malicious code in maliciouspackage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0e8a8d581266436f0546b5039ee82ab734d45f8489e281322dd871124dad9ce Clearly a demo malicious package, attempting to exfiltrate a token from the git config --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

MAL-2024-9058 Malicious code in cloudflare-docs-starlight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cc416353baa88972c0106ceb1b2fa7077b9cfbcd687be15e44c70ee5edc0c526 The OpenSSF Package Analysis project identified 'cloudflare-docs-starlight' @ 1.1.1 npm as malicious. It is considered malicious because: - The...

MAL-2024-12280 Malicious code in google-play-store (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0f8bc12f61546bde84dd1d7a64519fcdc55ce875b71f3d8d848d2d5daa2248d This is a copy of https://pypi.org/project/play-scraper/ with added a very questionable "telemetry": in scraper.py, L90 sends the user hostname, IP and the exa...

MAL-2024-8561 Malicious code in @diotoborg/quibusdam-libero (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d21208abe2f96cc5e0955a9e37a155bc5d3483f2d9daab5561627ad4a7e7e80e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10179 Malicious code in uconst (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cc4ce4d1709ad506513007356fd414ca83c1aa848f9134e952c4b760194428c6 Package "uconst" is the package containing malicious code with multiple stage, exfiltrating basic info as well as browser data. It's put into others as...

MAL-2024-8011 Malicious code in postman-open-technologies-knowledge-base-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a0f1159812781f3847a9da7e6b4455cd3f3ee8bd00da0eddbe589dd52d1d56e8 The OpenSSF Package Analysis project identified 'postman-open-technologies-knowledge-base-api' @ 1.2.3 npm as malicious. It is considered...

MAL-2024-6568 Malicious code in alipay-dualfun (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3874 Malicious code in watch-for-shazam-fury-of-the-gods-2023-full-online-free-streaming-at-home (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1588 Malicious code in leocare-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 311899bcdd83d3cd308268641290fc8fd0f503d308fc1bbf7488b5f0fab734cb The OpenSSF Package Analysis project identified 'leocare-new' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-964 Malicious code in ngpd-merceros-dynamic-forms-fe-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a63c636557949e167ac4cca437135be8c3160f70856ee5911c1817ba2c3f76a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-71 Malicious code in cordova-plugin-canvas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c72f98238b951534c1437dc8a7c3ee8ab8463beb50c44c59d07cccdd15829386 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-52 Malicious code in onetake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 52bec93f09b5dc6085214609ef35d8aaf2346d6e50e6a12e5304e16aa3493ae2 The OpenSSF Package Analysis project identified 'onetake' @ 1.1.30 npm as malicious. It is considered malicious because: - The package...

MAL-2024-33 Malicious code in d5-es6-sass-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3090df994b516cfc30ee58cc5871282f61ebc4e378a73744fb779705e16a1a35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8727 Malicious code in discord-selfbot-v13.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a28fa86e7d878dc6267f483fefbb3fdab0fe04ea75dffa4de10cc5ad899c5be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8719 Malicious code in figma-include-accessibility-annotations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcb17fd8a376f1c1967e4a54049e96bf34f63f71f41e75262db53f96e883d43d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8530 Malicious code in ifl-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a78e3ac1b585e32b8d93d41fa60e308981f4af36c1b67dedfe093df78770d540 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8486 Malicious code in @zscaler/ec-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 31bceaac08bb6d621ea722590b8ba815799a6af81cc537fa0796ea7983b0f1d2 The OpenSSF Package Analysis project identified '@zscaler/ec-domain' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8431 Malicious code in gatsby-starter-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bc23995a775ff33fc2732574cfd95b0d8efee1cdcadd229b67acde3123fac5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8423 Malicious code in @olxui/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a653affd18c77f72727a33c59b7baebb39d3a38ecec4a894d1eff832cbc0501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8394 Malicious code in npm-research-enum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32f39024ba535c374e98c41355c2663f4ae5a92ff25df3c0f8cc60837ec06d56 The OpenSSF Package Analysis project identified 'npm-research-enum' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8391 Malicious code in @banana-cake-pop/data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 62a20ff9ddb55a8de5c7bffe9455b25f0fca2223207e80cf7b9d7993bd02db12 The OpenSSF Package Analysis project identified '@banana-cake-pop/data' @ 1.9.10 npm as malicious. It is considered malicious because: - The...

MAL-2023-8372 Malicious code in tfb-cip-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32e06870354259889acef36568293e07f1ada3677bafaba74764237fb6fef9d2 The OpenSSF Package Analysis project identified 'tfb-cip-app' @ 7.8.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8361 Malicious code in enumerate-iam-aws (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 46f8fde812a7274ad1e270e0cc3a8698349365af5d85ee9b89248fa467e5bf2f Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

MAL-2023-8342 Malicious code in onno-missing-2023-full-movies-at-home-streamnig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0f74f65cd28f1a691661130f5fd88a71bbf299125018d4be7085f77e8138ffe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8335 Malicious code in agen-sbobet-judi-bola-online-terpercaya-paling-lengkap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a4f992569321418e44d0198225fca97602cc4663908efad4fc4772d1ef27ed7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8316 Malicious code in mtsinai-staging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8b8ce7354368bf548718481b77212b259ca68d7873bf856ab952feff9e5b79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8261 Malicious code in ubermenu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb6c884144ed475f1632aef6c970f42e0c168ca0eba55fdc931a6d7e5da6d69b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7925 Malicious code in nequi-api-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bf1340504c1cd5ad13f47a2e8c92aa8f58b41f2bfc9cbe68f77c055215dd9122 The OpenSSF Package Analysis project identified 'nequi-api-utils' @ 0.3.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1546 Malicious code in marionette-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4962667c8dd0da2bbc76d598b0820a7371844141b721e7d346913fae8581c733 The OpenSSF Package Analysis project identified 'marionette-ui-components' @ 6.9.2 npm as malicious. It is considered malicious because: - The...

MAL-2023-1543 Malicious code in lp-vue-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8e0fc5aaed8de1640179a965d23507da2a63fc462c9349da8ed2eae78398c577 The OpenSSF Package Analysis project identified 'lp-vue-components' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1455 Malicious code in bugvsme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d0f6358966f26aa77ad48efa632c53f6ac44fc322dfe78fbe31c03310c88c7e4 The OpenSSF Package Analysis project identified 'bugvsme' @ 1.1.1 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2023-1029 Malicious code in bluehost-wordpress-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 130f9a8e36740fd2a40d384f49218d898cfa0a619be16a71621770c1eed31c15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8357 Malicious code in arangodba (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8a8f8299dc6c21b2441da8a56c195b046c05f65c0ab9b78f08aff27eb1611ac7 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-1366 Malicious code in guiconsoles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 24a3798623a3f68e4c418540b53aa81d86785aeb5618a02914aa14be4c4311ba The OpenSSF Package Analysis project identified 'guiconsoles' @ 1.0.5 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-5233 Malicious code in py-intellibint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c51243b24c705c8e86f895cf56a4aaf31db49b64674882dbef77513f1bc075dc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-1337 Malicious code in virgil-spring-boot-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d7b81762635da58744d7567d3ac4b1bf12da5d3c72070a9d2260d40463fcdbb The OpenSSF Package Analysis project identified 'virgil-spring-boot-starter' @ 20.0.0 npm as malicious. It is considered malicious because: - Th...