MAL-2025-191079 Malicious code in bun-plugin-httpfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae0f656e3adcef8f66c427a2cc68a9a0e99581c1a429ab204f9451c59dab21a1 The package bun-plugin-httpfile was found to contain malicious code. Source: ghsa-malware...

MAL-2025-187577 Malicious code in janus-petrology-sedimentology-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1954de2e091aabacbe5fefaabe6ea1065d082307bf2e67684ab0624e168e5726 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186029 Malicious code in cat-compile-analyze-deploy-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9514ab2e174c3c41eef9112756070b30355f2acf2e0db624c254b0fbd779b0d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182482 Malicious code in imodiov-kugfi-comoldecoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f26b232b9cbabe1d390561f94aed8c551f37415d673d5371031c58d87ea7aa0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-191841 Malicious code in python-rootpath (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb867560d676e7b79ce110b230906a9630feb223cbcb6072bff5a2636c60a3c7 Hidden code downloads, saves and import a remote script. The package itself is a clone of a legitimate "rootpath". At the time of analysis, the remote script d...

MAL-2025-127889 Malicious code in kiki-klentik87-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 218c5f78811882e9efc6c4172c18e764e1c43575550a6046af3b006507c9a88c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-42680 Malicious code in @lbnqduy180500/probable-funicular (npm)

The package @lbnqduy180500/probable-funicular was found to contain malicious code...

MAL-2025-44336 Malicious code in free-v-bucks-codes-march-2023-fdkzldz (npm)

The package free-v-bucks-codes-march-2023-fdkzldz was found to contain malicious code...

MAL-2025-191912 Malicious code in tronlinknet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 61d63a54e62ad11fa6d3420324a6cd948450337ae9faf28d8372994c92c8f294 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2025-27321 Malicious code in netsuite-suitetalk-wsdl-v2020-2.0 (npm)

The package netsuite-suitetalk-wsdl-v2020-2.0 was found to contain malicious code...

MAL-2025-21257 Malicious code in gemini-install-server-radioastronomy (npm)

The package gemini-install-server-radioastronomy was found to contain malicious code...

MAL-2025-24372 Malicious code in keccak256-helper (npm)

The package keccak256-helper was found to contain malicious code...

MAL-2025-13768 Malicious code in @zalastax/nolb-react-sm (npm)

The package @zalastax/nolb-react-sm was found to contain malicious code...

MAL-2025-6794 Malicious code in num2words (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23a528edd10eb63e7c7932830fdb314983cadc840ce8ccfbaa04ad821bbdc1da The num2words project was compromised via a phishing attack and two new versions were uploaded to PyPI containing malicious code. The affected versions...

MAL-2025-6125 Malicious code in slf4j-api (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7ccd4cc3b9a566cde097a25dda1efca4dc2bc70d632e77b01f3e21128e03356 Any computer that has this package installed or running should be considered...

MAL-2025-5937 Malicious code in neolang-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a41d15d10a19dc41dd5c801307932369ed7f51380fcc0fdb1478e0ac2b7ce9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4350 Malicious code in garena-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e17b9725323610c84d0eef5b07fd9caf89a9ee0ad67d94c35a07c61abdafbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4365 Malicious code in jquery.currencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e84dbc5236755b427f757bbfee2cc19e5bcaa36be99d85cbe488921ecc812f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3645 Malicious code in shaderc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18b4edf61e87177ad04810a690eb7f35d3bb6c3771fe67e57ac3d9dca12fedca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-191816 Malicious code in pretty-cli-logger (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 94cd11911ce2a0937d9e56087ce9487db18da5bb20df7f1f8948f8356d65c31d Contains an obfuscated code that will download and run a remote script. At the time of the analysis, the remote URLs were delivering empty results --- Category...

MAL-2025-191944 Malicious code in zscaner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ee09d48ac6f9e7d0460c2a2bc7c9aaae013ce04ac342eb164683b214616e56d1 Campaign is split into multiple packages that altogether exfiltrates data from desktop Telegram application. 1. "pyapiepo" is a cover package that provides som...

MAL-2025-2958 Malicious code in eth-defi (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2759 Malicious code in f0-data-collection-service-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd259047f778caae5a62f90a3e65d036275f868a44c49abb25887167bbfdda91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1367 Malicious code in jbrowse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 718122d6ef307a963a9df00b5272528ab1af438eb21e93463a4fec2fb65e70ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-178 Malicious code in dbx-js-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2191dabfd9180ad79d00f6678faee7b75417b6a5ee484798bff290a81fa0d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11710 Malicious code in solana-account-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11552 Malicious code in ccl-leveldbases (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11418 Malicious code in peritter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e928152262a15c3663758b7d61ee855e89db1870d95ba6587ad86d367841c476 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11213 Malicious code in vareapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 296640ad50ffc63152ca94b0951a56c7ebc71e341ecae13dab648ae97fa99425 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10446 Malicious code in bytemlperf (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 abcc70611e2d35cabe7d6a6f7e88ff8f9fab7d9e2a42b0fc3c0d1f036c8582be A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-12287 Malicious code in hmac2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 055915f62eab8a5fe37b7501a3ed565a2aba267bdd69e82acaa13525bacf41a1 The package contains obfuscated code that exfiltrate basic data, and then executes commands delivered from remote server --- Category: MALICIOUS - The campaign...

MAL-2024-10178 Malicious code in trustdecoderss (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9463 Malicious code in @daimler-rcms/api-client (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9150 Malicious code in get-new-script-roblox-fishing-simulator-script-x5c6h7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d3935d85ffff584c274c803e27fe750e88812237d94029109b8e18bab26ab63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9181 Malicious code in script-updated-gta-5-ragemp-spoofer-hwid-unban-zcnl0m (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00fcb4f478bf592c6510a3d43d07dfc4d63123c22879dd45abe95f02e9b22006 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12255 Malicious code in discord-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b55230c05e2303e965a53322d83ead8df66e188c696755b26efefd96192a144 Package suggests being an api for discord. On importing the module, it attempts to find and exfiltrate leveldb databases from Discord apps and Chrome ---...

MAL-2024-8830 Malicious code in snacks-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a8a3330ca1864b23cbe8bbc0eb833f73409c288067d5d19632ac829de559932 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8404 Malicious code in @diotoborg/libero-culpa-occaecati (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 837c818767490d435de2632730e64489b2a1034d59e8a9b539d7af6482da2cc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7769 Malicious code in noblox.ts-core (npm)

This package is considered malicious because it contains a heavily obfuscated postinstall.js script with multiple stages of payload execution, resulting in the delivery of QuasarRAT. This allows command and control by a malicious actor. --- -= Per source details. Do not edit below this line.=-...

MAL-2024-7533 Malicious code in sap-albumid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7fe0f07187bb3f82051d6756258c9d8c60dbac38c7d1faa3f4b90eb1a976248d The OpenSSF Package Analysis project identified 'sap-albumid' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-6389 Malicious code in active-admin-advanced_create_another (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5381 Malicious code in mult-flow (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-2607 Malicious code in lib-comdig (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1661 Malicious code in govgen-governance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3df1a5ba7e5302cde15d6c6ab8220b80b3dd7d291cbdab4f06cac278dacf77de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1158 Malicious code in u-workflow.module.common.hour-of-week (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa993331c82ce09532f10dfb1eb3586e1a3343188c93733712aad7f47cb49539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1153 Malicious code in gatsby-theme-deriv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32ede5793754442e2e56bdb177dea81b15771050ced8976b1958a4eff4cd2b9c The OpenSSF Package Analysis project identified 'gatsby-theme-deriv' @ 1.1.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1142 Malicious code in lyft-service (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5c5cfee894c744725e11bab2574205709667faf82490a31e44b35c9e447fd962 The OpenSSF Package Analysis project identified 'lyft-service' @ 9.99.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2024-1134 Malicious code in raydium-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 047809b4a0221ee733d518e35e840150721d191fd909cb32946b259540c2bb1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1127 Malicious code in tslint-slick (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2759b172d96a68a7783fab890e408535923abfd9ef8760d01d1e9f12f7dd0ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1026 Malicious code in ent-profile-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f9c39ae8dadaf1b8ac82e8e1f7b312d04c58cb2a208ba535221cae3bac7ae787 The OpenSSF Package Analysis project identified 'ent-profile-api-client' @ 9.3.1 npm as malicious. It is considered malicious because: - The...