239729 matches found
MAL-2022-2828 Malicious code in eslint-plugin-translation-vars (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2d3f1b78d30920863239e9f77d1fb8208df96b4cf0e41bf69fd693bba483041 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-305 Malicious code in @gs-ux-uitoolkit-react/theme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de95451355b7b46a650d357226215bd7cde93d64ec11e898dd20ae64776dc351 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-689 Malicious code in @umpirsky/country-list (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee80226f6b6326ea4c985aaff2fac56825152a2759c76c4d9862b0ef5b8deddb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2126 Malicious code in common-xc-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7011cde5d5e1828b1ff202a57e065f667ff2b4e6097a7d26113c2e651a2959f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5943 Malicious code in sbb-angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a33d562d292f4f9490f63efcfa905adb29084516d148a57d0052a57feb01582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3458 Malicious code in grenache-nodejs-example-fib-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ee9306daace1d864f600eccf0dab6fa8d42246644e8eec87d4dc82f3b9853a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3838 Malicious code in ing-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ae4520b2488caee355b4ef634b87188adc7456ff382a74f1e5edc1c9426f9f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1585 Malicious code in bitcoin-json-rpc-adapter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6343f2f77d5f772e6b17c00fed2653e9c0c887f0e0ae1fda00de4b0cde9f8ca5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5719 Malicious code in red-bull-global-onboarding (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fc2cabc6b5fc2953eeef7d540efd8cffef5aae91d5ec54c33eee91305b7007a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-375 Malicious code in @kaspersky/fetlife-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 353c3be162a0520ec9a4097a45b0b3df2fc85b4ac6993fc40cca5a13708e3e4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-274 Malicious code in @firecracker-microvm/fetlife-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8236413fb62d06e91b2b92e2f28c0616770da58942a69c29277bd2d2fb8d81f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2353 Malicious code in datadog-synthetics-github-action (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdb7d5c2b8247d500672b7c1089217058c98f072aa33d33e0f42bb0711fab357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-503 Malicious code in @pixiv-vroid-hub/vroid-hub-viewer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 643ea88d758e2e4fb1075356094d349c0e431e12fc3202f9d6a7c9d88d7645cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17762 Malicious code in @coopeuch/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope...
MAL-2026-17342 Malicious code in @bellaxchuu/belbails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17645 Malicious code in vectorizers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1082db2b4593a2b60921a85d2f4c760a294a67b1a48007959d75d61f670dc87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17644 Malicious code in random-certs (npm)
[email protected] was published to npm on 2026-10-07 04:22 UTC by user weindeste. It presents itself as a generator of random self-signed certificates, but sample/cert.pem holds base64-encoded JavaScript between the PEM markers instead of a certificate. index.js lines 41-52 reads that file, stri...
MAL-2026-17642 Malicious code in personio-pipeline-projen (npm)
personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username,...
MAL-2026-17606 Malicious code in lighthing-invoice (RubyGems)
RubyGems runs this gem's native extension script ext/lighthing-invoice/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...
MAL-2026-17563 Malicious code in risk-detection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b74a904a25687bbc34ad321ea019c5083f9a3651457750ed36207a209798f77 package.json declares a dependency ltidisafe whose source is an off-registry tarball URL...
MAL-2026-17505 Malicious code in dotenv-promises (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 254f0bcbb8014fb07414eb0b41a898deac682aa8c8b7a8541a0f7538ac274f9a The package is published as 'dotenv-promises' but its bundled manifest declares the internal name '[email protected]' and mimics the dotenv API...
MAL-2026-17248 Malicious code in xeprews (npm)
The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
MAL-2026-17196 Malicious code in donutpromotion (PyPI)
donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...
MAL-2026-17189 Malicious code in chai-as-relay (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c65319b0e17f945fc57f482eb174e5d7fe70e63a380cb24f64eea1808bdad2f Package main index.js unconditionally requires./lib/config at module load. lib/config.js is a single-line 4.4MB obfuscator.io-packed IIFE hex-escaped...
MAL-2026-16464 Malicious code in hachutis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 455f1d04545c9ed17722705fe61415d7e536e2800c2a3c588ab69985004c73b9 The tarball ships three undeclared prebuilt executables under bin/ bin/cli, bin/cli-linux-amd64, and an 81 MB Bun-compiled bin/cli-http-linux that ar...
MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...
MAL-2026-16368 Malicious code in mathmain (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24c3869fb4f125e9ea39f09e5cb9100458e4e2d364047150204909e56527785 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16201 Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
MAL-2026-16141 Malicious code in platform-telemetry-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS...
MAL-2026-15873 Malicious code in btree-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180c50a02e5bbe5a57f622112bba7f7b01becd6cf85f6d9d4b8301699f4334b7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15828 Malicious code in env-validator-tool (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964 The package ships no source module only egg-info metadata despite declaring a consolescript entrypoint 'env-validator=envvalidator.cli:main' that...
MAL-2026-15822 Malicious code in @stellarshift/chain-metadata (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932d9a57667edad733439fadfc1754573429369cb8e65fe094c7bed1ed81c5e6 The package's postinstall lifecycle script fetches and executes arbitrary code from a remote URL that is stored XOR-encoded in endpoint-registry.json...
MAL-2026-15824 Malicious code in @stellarshift/token-units (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...
MAL-2026-15634 Malicious code in tailwind-minanimated (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2 src/index.js appends a hidden payload after 9KB of whitespace padding that decodes and runs via evalatob... whenever the package is required the READ...
MAL-2026-15636 Malicious code in tailwindcss-forms-style (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after...
MAL-2026-15572 Malicious code in grafeno-payments (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7af58da84956e51749cbb96923f12264cfdee76456b5010b526599b7da2c0caa On npm install, package.json's preinstall hook node preinstall.js || true auto-runs a script that 1 enumerates process.env for keys matching...
MAL-2026-15568 Malicious code in manager-thedate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ceffc24ee0bb4a8d23a2d545605b2ed2b686e9934b4f50c9fa24df3c980f04ed The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15534 Malicious code in firestore-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...
MAL-2026-14905 Malicious code in 3layerdipstackrcuf3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f32fc4b5be00ab27d18166f1514a8f15761114c074e5d674aab11e8418fe715 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14891 Malicious code in 3layerdipstackqjq77e (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f320682123c83343a81c91e396664d2bd5a949a41ce07bffc822f83502648979 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15370 Malicious code in secure-test-browser-jiyi62e9 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b99ef78cc33d5f685d3eb2a396ff9baf33d4ff555ecd8ff16490e48caa042e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15726 Malicious code in micro-clean-gem (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-14355 Malicious code in fuel-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...
MAL-2026-14316 Malicious code in expect-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e The package's main entry runs a worker that performs an HTTPS GET to https://realase-0626.vercel.app/api/v1 and passes the response's parser string...
MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...
MAL-2026-14113 Malicious code in sui-move-rpc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cceb15de1ddd23a55de69afe59a00c79dcc23f8ce3dfed33592d781bddfbb5a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14062 Malicious code in tw-pkgprobe-7731 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...
MAL-2026-14059 Malicious code in autbank-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d On npm install, preinstall.js enumerates process.env for keys matching credential substrings KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH...
MAL-2026-13993 Malicious code in @caspianph/second-npm-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c167d81cfacb0675a51ad6d83fcf2960324cf66f7c506a725fed48c8023c8d77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-13851 Malicious code in @years18/n8n-nodes-utils-helper-e (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70df151b0a3f6d74618b466c9d7ac91e18389b38a805e2010b55202b5722330 On npm install, this package auto-runs callback.js via a postinstall hook and repeats the same behavior in index.js on require. The script shells out...