239675 matches found
MAL-2026-1673 Malicious code in chai-await-chain (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee42e0ab59b1093e2cb5da46d6e015073bbae0cba06eb9a0720df44e54c9c111 The package chai-await-chain was found to contain malicious code...
MAL-2026-1672 Malicious code in chai-as-sync (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 201c3097a1417370d6190e60489ac7894d63b574004eaa2b069958131ea2eda0 The package chai-as-sync was found to contain malicious code...
MAL-2026-1669 Malicious code in chai-as-prompt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b773fc994ff2fb27407b9ab4482deb4ab95bf5d772a226a80db73f0e0740b8b The package chai-as-prompt was found to contain malicious code...
MAL-2026-1654 Malicious code in aligntypeer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183e67707e27ac2c677e51c47293159521704492da3c056e94f2c83927a1b01a The package aligntypeer was found to contain malicious code...
MAL-2026-1651 Malicious code in ai-fast-auto-trader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8b2575eb64d69c961ae4e503747238d564d354049b7bdc75c814eceaa941fd5 The package ai-fast-auto-trader was found to contain malicious code...
MAL-2026-1650 Malicious code in advertising-shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72c8f6eb16d0fa51374dcf78f95b3a6c9ac1ffcf8c72a0995c6425df9f83182 The package advertising-shared was found to contain malicious code...
MAL-2026-1648 Malicious code in advertising-events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9e784ce1a0573b476f4232dcdc6136efaa217d3483765875dbea0aae015542d The package advertising-events was found to contain malicious code...
MAL-2026-1642 Malicious code in @upstashed/context7-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570280cb87bacfa8bbf1ce7b89fa14845c922e464e6964a22584d2e6ff2e197d The package @upstashed/context7-mcp was found to contain malicious code...
MAL-2026-1633 Malicious code in @nxt-costco-com/forge-icons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 641344edeaa32a2f52f1274b17c2ba52ff688d8bbdc91484e29840bf7a9c5dae The package @nxt-costco-com/forge-icons was found to contain malicious code...
MAL-2026-1630 Malicious code in @measures/responsive (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e32ee5d76a578e04ae48dc0f9a6cea0cdfe505dd50a0e61b7d44e88dcbdf9a5 The package @measures/responsive was found to contain malicious code...
MAL-2026-1625 Malicious code in @kui-react/button (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb2774da41feb2f5825c18cb59ff37b64a456fd5770d202cc5542aaaa634f4df The package @kui-react/button was found to contain malicious code...
MAL-2026-1623 Malicious code in @f5rest/odata-v4-service-metadata (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3183cb83976cbb4d5011bae853bc65c285e5204ca17b1435d5ce6801dcfd9e2a The package @f5rest/odata-v4-service-metadata was found to contain malicious code...
MAL-2026-1467 Malicious code in n8n-nodes-csv-parse (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011372ed1f40a4259802291679f8db573c8435e904c38e02482b4589d16c60c7 The package n8n-nodes-csv-parse was found to contain malicious code. Source: ghsa-malware...
MAL-2026-1504 Malicious code in transform-jsbi-to-bigint (npm)
The package 'transform-jsbi-to-bigint' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
MAL-2026-1412 Malicious code in project47 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a3f77d5ebfcf087b4f055d7ce552ee0165eadf99d8cc6dcd0f3c767393099d27 Facebook hacking tool that also forces the user to follow specific accounts --- Category: MALICIOUS - The campaign has clearly malicious intent, like...
MAL-2026-1411 Malicious code in nfd (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 09861068d4a40cdebd80dae1ae4db85b45498bdb1f7f039cf44b33f41e68534f Facebook automation/hacking tool, with a part of its code obfuscated. Given that other packages from this uploader exfiltrate user's credentials, this is likel...
MAL-2026-1384 Malicious code in @lux2/ssr-catalogue-sfcc (npm)
Package collects system info, exfiltrates data to a suspicious IP, executes shell commands, and uses pre/postinstall scripts. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b625e0932d70166d526fb8fa4993c8c448699203e795ad308cfe52cd784b28ff The package...
MAL-2026-1257 Malicious code in pdfjs-dist-fourth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcaf355459e8baaef860a557036e51431e6eb6c44dcba0e800579cf978f2f64d The package pdfjs-dist-fourth was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-1139 Malicious code in fwk-amigapython-rest-server (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9694db9e75e6f3f31137edfba3f3a51ede2881961ee930ea4a4b02e1be086fc8 During import, only in specific environments, a module containing code disguised as telemetry is imported. This code then exfiltrates sensitive environment...
MAL-2026-1104 Malicious code in bubble-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bac16503e5a840ccf7e88977f38fac02affaa1c8eaff7f449b9832fa03cbd0a8 The package bubble-core was found to contain malicious code. Source: ghsa-malware a4122cb6b21018902fe682cf3dd31246d52f8850e8116649894d89df6f06acb2 An...
MAL-2026-1080 Malicious code in hashtools32 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 689514b83cd6496b0a4213d26325e73cd2c4f0e19128b969d19797bcdd4b131d During import, the package attempts to exfiltrate sensitive Telegram session files --- Category: MALICIOUS - The campaign has clearly malicious intent, like...
MAL-2026-1232 Malicious code in @schedaero/yukon (npm)
Multiple evidences indicate malicious behavior: suspicious URL, data exfiltration, process exiting, and preinstall script execution. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02868b7ba4a5e5bf754e692e348191e6974f2f707417f20f97b33f172cda4ca The package...
MAL-2026-987 Malicious code in vl-ui-accessibility (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7e52c3145cd55d304bb64380b4ac900f8fcda605ef0d88ad4b445709c1fa6f The package vl-ui-accessibility was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-983 Malicious code in tensorflow-opt (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 c2197ee3bfb727ff46f407a50a515013ad05c423bfe202eea90eb6b593f08b14 Package is likely a dependency confusion against some legitimate extension packages for TensorFlow but contains just cryptominers. When calling the "start"...
MAL-2026-774 Malicious code in adminbypasser (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 867991d0e6c74f15c2f231c002867172a4e03044a328676cf9b2ec07a7e48f68 Package silently downloads remote code and adds its execution to the autostart. During analysis, the remote domain no longer existed. --- Category: MALICIOUS -...
MAL-2026-700 Malicious code in tabulapys (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f43be05d02e16c7d381e105a4eae9a2701039d29435e6d83cb982f607bda623d Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...
MAL-2026-613 Malicious code in fastpi (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2928970260fda87aaa57272b8042ae1a9661ad1a1bdeec1e73903e84ce3354cd Malicious copy of the legitimate FastAPI. The modification loads code encrypted in one of the attached files. The final, highly obfuscated code is most likely...
MAL-2026-510 Malicious code in radishwxm5 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4cbabb01d98bcad5705b98f5aac22b9d8f53e8c97e2fe5ab8bca66661e6c0644 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-444 Malicious code in terminalbrush (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 35e06fb41f9c1a4f082cf49a72dec89fc5b4d2f6580b97e527d291d50807b801 Package downloads an executable, places it distinguished as a Python binary and starts it. At the time of analysis, the URL was no longer active, so it was not...
MAL-2026-926 Malicious code in auto-backup-wsl (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a2df4191bfbdaa28acd42677c912064639ef3b278179beee064cd83fb5b0e11e Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...
MAL-2026-35 Malicious code in aiihttp (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e98bbfaaccc91213e80bb0a09f5081a5701cf01629ac8b82370adbbbc42178b0 Obfuscated code downloads an encrypted binary blob, which is malware finally starting cryptomining. After starting the malware, the Python package uninstall...
MAL-2025-192685 Malicious code in hooktest-fin (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 87e6fba5c0ac4b5359cb360a5dbf68404d0b8559bd94a9f4c33fdad09559b241 During installation, a script to execute remote commands through a Discord bot is installed, ensuring its persistence over reboots --- Category: MALICIOUS - Th...
MAL-2025-192550 Malicious code in fruit-malicious-xml-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c330d59c7529d320701e6ccf11a655110e1aeb7c9ad5d15c34ba10941c6343a6 The package fruit-malicious-xml-parser was found to contain malicious code. Source: ghsa-malware...
MAL-2025-192467 Malicious code in gxzip (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8e0dd8700d5267b8d9bbe270798b11d2250761decf1de89249eab6d90a29080c During initialization of the archive-support class, the package starts code from another file and downloads multi-stage malware --- Category: MALICIOUS - The...
MAL-2025-192436 Malicious code in jsonschema-utf8 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 61bf4fa82a7c398e580d547d641bc19e3b16ba446191da04f39dcf9cf9a41eab Package clones a popular package loguru, jsonschema, .... While it claims to have some additional features, the real change is an added compiled native library...
MAL-2025-192351 Malicious code in evil-rce (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 74a74a4133ed8082eba8452bb59a82dcf6975e1e8c4d6630a47088c17d6b6cca Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce...
MAL-2025-191946 Malicious code in gtkfuscator (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron 83b5a97c937ac16481e2ad27346069180a0a823c5f6b361cc4e7f08e97716c24 This package decompresses and executes a base64-encoded malicious payload...
MAL-2025-191557 Malicious code in codemirror-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788b98a42ba1658c92e6e86494ddd747ab154a01be456dfe9656760bd264fe46 The package codemirror-5 was found to contain malicious code. Source: ghsa-malware 0803dd9e41e867827659b46d2934d1a9700667e0f731dce60093ab5f9457c07f A...
MAL-2025-187577 Malicious code in janus-petrology-sedimentology-polaris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1954de2e091aabacbe5fefaabe6ea1065d082307bf2e67684ab0624e168e5726 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-180079 Malicious code in teate-thy-py-mami (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f9b0bf6fab350eb5f06aa1862d38e79857180193e4abd22b8049b91df3e8397 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-127889 Malicious code in kiki-klentik87-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 218c5f78811882e9efc6c4172c18e764e1c43575550a6046af3b006507c9a88c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-44387 Malicious code in generate-unlimited-coin-master-spins-march-2023-dkdzdz (npm)
The package generate-unlimited-coin-master-spins-march-2023-dkdzdz was found to contain malicious code...
MAL-2025-191912 Malicious code in tronlinknet (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 61d63a54e62ad11fa6d3420324a6cd948450337ae9faf28d8372994c92c8f294 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
MAL-2025-21219 Malicious code in gazebo-falcon-qm3s (npm)
The package gazebo-falcon-qm3s was found to contain malicious code...
MAL-2025-25073 Malicious code in ledvance-living-style-guide (npm)
The package ledvance-living-style-guide was found to contain malicious code...
MAL-2025-21257 Malicious code in gemini-install-server-radioastronomy (npm)
The package gemini-install-server-radioastronomy was found to contain malicious code...
MAL-2025-27321 Malicious code in netsuite-suitetalk-wsdl-v2020-2.0 (npm)
The package netsuite-suitetalk-wsdl-v2020-2.0 was found to contain malicious code...
MAL-2025-13768 Malicious code in @zalastax/nolb-react-sm (npm)
The package @zalastax/nolb-react-sm was found to contain malicious code...