239659 matches found
MAL-2022-2072 Malicious code in com.unity.modules.cloth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73fa5561168828ff20e8d08cc6c12e8de395a63dcdf1e1e742191a69e8a03539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-811 Malicious code in ac-animation-sequencer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7595dea4b4bf14edbd22f889a9d64c68692b172c8ffbbc5684b3903c81aeafd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5943 Malicious code in sbb-angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a33d562d292f4f9490f63efcfa905adb29084516d148a57d0052a57feb01582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3738 Malicious code in hypercore-logs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41ad55ac1ce974e546de492e35db0b27f3f3e4e28404c6bdf3311211a2c58be3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1301 Malicious code in azure-communication-identity (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fce91f9bdf08c4b0fc0a41b7d81163d195792e05edbe2d2f8bd0164ff9a05fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1303 Malicious code in azure-communication-phone-numbers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eebc84b85319ed6d2f36c9fc902fe8dbf16a721c397be33473db4cca00811c8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1307 Malicious code in azure-confidential-ledger (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 990af1e5ea3a4d642497c5f273b8dcebb97f2f5b201295507b68326d1b424b52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-675 Malicious code in @twitch-easymode/endpoint-service-loadbalancer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1363444d8b414cabc8b2cf9220bc4c1dcaaed9d95e795a6ccf06ee814a98b0c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5639 Malicious code in react-dnd-examples-decorators (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b335bf9dc6443f555a9a3ebeeadd7bebecedee805e6bf3c7d0eb551895a34647 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3171 Malicious code in free-fortnite-skins-verify (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a36b3677b70a09c6c24c79463b185e1111dc67b9cddd4dace6b9fc0efabc246 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3155 Malicious code in free-fortnite-skins-fortnite-skin-codes-2022 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf05b9e8ed7f0a9a9b9d9d14a47a5ef04e0f916a57dbdaa467d621a96e5b5c92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1715 Malicious code in buffer-fetch (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90e069e0b257c2c44767bc83c877dfad638c54bed27449cb150292068db051c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6911 Malicious code in vgs-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea7450a9256eaa2a5b3697fa941aac508944ea795e005119495b21835bbe195a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3306 Malicious code in gd-garnish (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c778e61ec4891f2f368b6d02a96722f235bff111f06041dd77b2031b9859724 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3838 Malicious code in ing-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ae4520b2488caee355b4ef634b87188adc7456ff382a74f1e5edc1c9426f9f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1585 Malicious code in bitcoin-json-rpc-adapter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6343f2f77d5f772e6b17c00fed2653e9c0c887f0e0ae1fda00de4b0cde9f8ca5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-1234 Malicious code in azure-api-style-guide (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 257d088a2c56246e87ea0068e7e5ffa617d5f06a13dac71c7aca131ab34dcf04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5373 Malicious code in plugin-transform-react-jsx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f27c2a663077678179b48cd4851aa8b5aa144a1d4ef1e3bb2cf05526d0b1c7c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-7256 Malicious code in www.podium.com (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f758b50ddd97444c80316f4016410c194b9b0c3bcffdc366146ae2a5824673da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-5719 Malicious code in red-bull-global-onboarding (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4fc2cabc6b5fc2953eeef7d540efd8cffef5aae91d5ec54c33eee91305b7007a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-274 Malicious code in @firecracker-microvm/fetlife-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8236413fb62d06e91b2b92e2f28c0616770da58942a69c29277bd2d2fb8d81f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-607 Malicious code in @spinak/iac-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77099501462f80e29fcba9337b4c51a78859cfed8347211f50acbafee737a3ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-503 Malicious code in @pixiv-vroid-hub/vroid-hub-viewer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 643ea88d758e2e4fb1075356094d349c0e431e12fc3202f9d6a7c9d88d7645cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17626 Malicious code in serpacksven1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d4a6a2715973b427bb0aa2b7a493ca711b7f16b5f47f90062edf790e0186a6 The tarball ships no JavaScript — the declared main: index.js is absent — and contains only 10 byte-identical copies of a PowerShell dropper under...
MAL-2026-17563 Malicious code in risk-detection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b74a904a25687bbc34ad321ea019c5083f9a3651457750ed36207a209798f77 package.json declares a dependency ltidisafe whose source is an off-registry tarball URL...
MAL-2026-17543 Malicious code in @inpeek/odata-angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...
MAL-2026-17286 Malicious code in queeuees (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f793adc7f1d26294831307abed18a284d7834d8e4733a8b05d9863bf2d70c60d Queeuees 0.0.1 ships two top-level packages, Queeuees and Queues, with byte-identical init.py files. Each init.py assembles a byte blob from...
MAL-2026-17245 Malicious code in exptrdd (npm)
The package exptrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...
MAL-2026-16360 Malicious code in @uh-platform/nadaver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66c8fbea9d97af1bd5c48147e744ff5e0feaded686c613591e7defd2f75e2e17 On npm install, the package's preinstall script executes node index.js, which shells out curl to...
MAL-2026-16172 Malicious code in @biz44/runtime-utils (npm)
This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...
MAL-2026-16139 Malicious code in tailwind-form-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...
MAL-2026-16070 Malicious code in @fyxzpediaa/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175 This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect reconstructs a UR...
MAL-2026-15942 Malicious code in omni-channel-order-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5286224ab4427b1e85bbdfd5e57b9d96fc9736504d17f2f31839562f19b88ee The package name and 9999.0.0 version are consistent with a dependency-confusion lure targeting an internal omni-channel-order-frontend package...
MAL-2026-15827 Malicious code in company-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85 companysdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys /.ssh, cloud...
MAL-2026-15828 Malicious code in env-validator-tool (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964 The package ships no source module only egg-info metadata despite declaring a consolescript entrypoint 'env-validator=envvalidator.cli:main' that...
MAL-2026-15826 Malicious code in tailwindcss-fluid-styles (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9b69dc0a9e6eabb685fa4be860fa456d8810c712ab300ff87023d72cf93631 src/index.js executes an evalatob... blob at top level on require. The decoded loader queries Ethereum RPC endpoints for the latest transaction from...
MAL-2026-15638 Malicious code in test__123q2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b08920ddaa70b578792ec7097f9d47047bdfe436a44475ed8274037ce6d6386 On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an...
MAL-2026-15634 Malicious code in tailwind-minanimated (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b5ade01536ccd988686907972ea2cc90b1c4abb91921604bea47ab7a53c7e2 src/index.js appends a hidden payload after 9KB of whitespace padding that decodes and runs via evalatob... whenever the package is required the READ...
MAL-2026-15644 Malicious code in @pipi596888/ccursor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c50ec8f5306971a2465653457f2ef36e6dbf14a666d9d8abff92af034fe5cef The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15602 Malicious code in redis-cookie-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c94026a508b2ada8c891551c8ccd622f86c2ba2e7b6a7c181fc3eb538e2f1f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15572 Malicious code in grafeno-payments (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7af58da84956e51749cbb96923f12264cfdee76456b5010b526599b7da2c0caa On npm install, package.json's preinstall hook node preinstall.js || true auto-runs a script that 1 enumerates process.env for keys matching...
MAL-2026-15544 Malicious code in sentrykit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7070cc1752fa75b405bdd0617a934d29519df28fdd0d069c0d4b5f7adaf44f55 package.json declares a self-referential dependency where the key sentrykit maps to the bare HTTPS URL https://repo.securityctrl.com/sentrykit instea...
MAL-2026-14905 Malicious code in 3layerdipstackrcuf3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f32fc4b5be00ab27d18166f1514a8f15761114c074e5d674aab11e8418fe715 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15344 Malicious code in secure-test-browser-fndndxw5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a6a223d9f1a80f9abeeabc995ebc539d59a16f9596264ce0ac203f279ad78e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15279 Malicious code in secure-test-browser-3bpg8lyh (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ffed8099f6074e8e5e93be31f9b3455f441e17b8b244eb9d430e7d4e695dc03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14586 Malicious code in @fleetbo/svro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d86373813cd4d2b65edb11f6a3f352ad81a55e7de0444884f66b0adb482e661 The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled identifiers 0x56260b, 0x12d64...
MAL-2026-15618 Malicious code in tesgfvbncsdbcv (npm)
Published as part of a ClickFix-style fake-CAPTCHA phishing campaign documented by OX Security see reference. The package's only file is index.html, declared as the npm "main" entry; package.json defines no preinstall/install/postinstall/prepare lifecycle script, so the payload does not execute a...
MAL-2026-14355 Malicious code in fuel-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e35f4772b8cba3555519c250662c67395bf57d89feed3feba7ea067b6bb2c27 The package's postinstall.js script executes automatically on npm install and collects host identity plus environment variables os.hostname,...
MAL-2026-14235 Malicious code in config-helper-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...
MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...