MAL-2024-52 Malicious code in onetake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 52bec93f09b5dc6085214609ef35d8aaf2346d6e50e6a12e5304e16aa3493ae2 The OpenSSF Package Analysis project identified 'onetake' @ 1.1.30 npm as malicious. It is considered malicious because: - The package...

MAL-2024-33 Malicious code in d5-es6-sass-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3090df994b516cfc30ee58cc5871282f61ebc4e378a73744fb779705e16a1a35 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8727 Malicious code in discord-selfbot-v13.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a28fa86e7d878dc6267f483fefbb3fdab0fe04ea75dffa4de10cc5ad899c5be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8486 Malicious code in @zscaler/ec-domain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 31bceaac08bb6d621ea722590b8ba815799a6af81cc537fa0796ea7983b0f1d2 The OpenSSF Package Analysis project identified '@zscaler/ec-domain' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8431 Malicious code in gatsby-starter-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bc23995a775ff33fc2732574cfd95b0d8efee1cdcadd229b67acde3123fac5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8423 Malicious code in @olxui/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a653affd18c77f72727a33c59b7baebb39d3a38ecec4a894d1eff832cbc0501 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8394 Malicious code in npm-research-enum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32f39024ba535c374e98c41355c2663f4ae5a92ff25df3c0f8cc60837ec06d56 The OpenSSF Package Analysis project identified 'npm-research-enum' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8342 Malicious code in onno-missing-2023-full-movies-at-home-streamnig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0f74f65cd28f1a691661130f5fd88a71bbf299125018d4be7085f77e8138ffe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8316 Malicious code in mtsinai-staging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8b8ce7354368bf548718481b77212b259ca68d7873bf856ab952feff9e5b79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7925 Malicious code in nequi-api-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bf1340504c1cd5ad13f47a2e8c92aa8f58b41f2bfc9cbe68f77c055215dd9122 The OpenSSF Package Analysis project identified 'nequi-api-utils' @ 0.3.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1546 Malicious code in marionette-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4962667c8dd0da2bbc76d598b0820a7371844141b721e7d346913fae8581c733 The OpenSSF Package Analysis project identified 'marionette-ui-components' @ 6.9.2 npm as malicious. It is considered malicious because: - The...

MAL-2023-1543 Malicious code in lp-vue-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8e0fc5aaed8de1640179a965d23507da2a63fc462c9349da8ed2eae78398c577 The OpenSSF Package Analysis project identified 'lp-vue-components' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1455 Malicious code in bugvsme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d0f6358966f26aa77ad48efa632c53f6ac44fc322dfe78fbe31c03310c88c7e4 The OpenSSF Package Analysis project identified 'bugvsme' @ 1.1.1 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2023-1029 Malicious code in bluehost-wordpress-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 130f9a8e36740fd2a40d384f49218d898cfa0a619be16a71621770c1eed31c15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8357 Malicious code in arangodba (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8a8f8299dc6c21b2441da8a56c195b046c05f65c0ab9b78f08aff27eb1611ac7 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...

MAL-2023-1366 Malicious code in guiconsoles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 24a3798623a3f68e4c418540b53aa81d86785aeb5618a02914aa14be4c4311ba The OpenSSF Package Analysis project identified 'guiconsoles' @ 1.0.5 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-5233 Malicious code in py-intellibint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c51243b24c705c8e86f895cf56a4aaf31db49b64674882dbef77513f1bc075dc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-1337 Malicious code in virgil-spring-boot-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d7b81762635da58744d7567d3ac4b1bf12da5d3c72070a9d2260d40463fcdbb The OpenSSF Package Analysis project identified 'virgil-spring-boot-starter' @ 20.0.0 npm as malicious. It is considered malicious because: - Th...

MAL-2023-12 Malicious code in tzinfo-i18n (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 80d76ff3efd3a37e90d86c31f34ad01633504eb17709869928335523c66a2a55 The OpenSSF Package Analysis project identified 'tzinfo-i18n' @ 0.1.0 rubygems as malicious. It is considered malicious because: - The package...

MAL-2023-449 Malicious code in fluent-ui-react-latest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d4f214d34026a7c88fc092754888c5c4c127f5cead75c2e93a25b2a3e3cc403 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6269 Malicious code in spring-boot-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24c0313226e487a37c9158c78bc620c0306eb778d0aa789677c0c77811785295 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1468 Malicious code in base64-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d462341360820f858bf3682fcc3be6c7b9407fc903061b5b1ad70b88b81e9969 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-958 Malicious code in amazon-s3-find-and-forget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbd98702f102af95fe423652401d4b74a3f550cd99ad34ffad5f9a4e47659cce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4801 Malicious code in nestjs-ldap-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d65363e22ae6934a381048355dec14bb6b668cfc1d21b311be5ed9d15cd12bf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4355 Malicious code in localforage-memorystoragedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3951d8b310f20db5759fcddf4d5c1a2d783af4020561437e9411b719adb83011 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2352 Malicious code in datadog-serverless-macro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba2ee7b3443a0229199bf0f65989cd56d3cc784e7f184562cd9a3d74c8501f4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5522 Malicious code in purple-bitchs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f72c762ac4691edd746e10d2500da450f31dde8c149ff3eee267b86dd413cce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5299 Malicious code in perfetto-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6100763973b89540aee1624736a341bc237fd9d4e58872345d6b8b8780fc754 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-234 Malicious code in @epc-apps/api-outages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52303d5ff48784b5ed46373ac7162f5ddc5ed3c8c629c696ccacba4c15d8e587 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17543 Malicious code in @inpeek/odata-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...

MAL-2026-17243 Malicious code in express-nodejs (npm)

The package express-nodejs impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17199 Malicious code in scrapetools2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233 scrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways eu.orbitor.dev, dget.top,...

MAL-2026-16455 Malicious code in some-tool-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e053568381d2b1cf3b7e62e3152651c843cfc3e32f056574d7a64dae4531b2e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16313 Malicious code in test1gg234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare I...

MAL-2026-16218 Malicious code in tol8t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c33f4cd3c64d0ca0eb65dc5947fce3700c94ec8bea6083e63da1e6ba31321e27 package.json declares preinstall and postinstall lifecycle hooks that use wget to POST installer host identifiers to a hardcoded Discord webhook at...

MAL-2026-16139 Malicious code in tailwind-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...

MAL-2026-15935 Malicious code in proxycer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2286dac5be0a9e8cc2e7b1ff92253d4b09beb0c43d5e795b9b9ea1391e6f8764 The package's top-level init.py imports starts.py, which is a single-line loader that reverses a 100KB string literal, base64-decodes it, marshal.loa...

MAL-2026-15912 Malicious code in tailwind-aspect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ba6037f5f2f65c0ceef0ba5bd8da931b7860a85e7a38fb2703ad4cd7672ddf The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js,...

MAL-2026-15907 Malicious code in tiny-folder-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb7707665659f287294c31f37c4eff9ceba537e9b54859837615929c296a9540 [email protected] declares a postinstall script src/build.js that runs on npm install. The script performs a DNS TXT lookup for...

MAL-2026-15632 Malicious code in node-request-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0832f8d4554223aaaf958a5f008faa621b29c39f428c4fb042c084c05c4c7cef On npm install, package.json's postinstall runs index.js, which on Windows hosts downloads a JavaScript payload from...

MAL-2026-15625 Malicious code in evilpostinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846e500b06f58769a2cb833be8e726ab1db04b327f4c614da6642eb46ae7dfe5 The package's postinstall lifecycle hook pipes the output of env through nc to a host reconstructed at install time from the package version string v...

MAL-2026-15626 Malicious code in fuels-forc (npm)

The package 'fuels-forc' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b993583bec4136d0b060dc6391c10e15f836e605b5b13b97dea6bb7a3dc1e5cd bin/cli.js runs whoami and reads os.hostname / os.platform, then POS...

MAL-2026-15587 Malicious code in real-browser-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 276e32a0246539a0495937fdf1967c9f2c778d4e902f14bc921148e4edbb0648 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15586 Malicious code in originaldevelopmentstelemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60940a80ca72863b54a3cc8f1cc7da49be77b38e9111d4cb77cfc1417671f399 The package is advertised as a telemetry utility but its sole exported function, downloadAndRunClient, downloads updater.hta from...

MAL-2026-15573 Malicious code in grafeno-webhook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79e333edbcad465f3e5bdfafa8dc4ba91589d66e12c201bb9e1ed4037cb16c36 The preinstall.js lifecycle script executed automatically by npm install performs three hostile actions against the installer's machine. It enumerate...

MAL-2026-15040 Malicious code in classlink-8ockomn3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23552c09e66a28e88af0501793f5821d43be5b68445ff78ce3af0179d820802d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15674 Malicious code in bamru (npm)

This package presents itself as a "System binary configuration tool" — that is its entire manifest description, with keywords system, binary, util and config, an author of "SysDev", and no repository. What it actually installs is a concealed clipboard and screen harvester that elevates itself to...

MAL-2026-14427 Malicious code in chai-as-mno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e94e194f078c230d6c6b15efcddc54b133fd52c890a55b0f8bdb4c680452381 The package name mimics chai-as-promised and its README, badges, and license text are copied from an unrelated project pino, while the package.json...

MAL-2026-14405 Malicious code in create-json-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14334 Malicious code in arone (crates.io)

arone is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...