239548 matches found
MAL-2026-1942 Malicious code in clob-client-sdks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d71cb09660dc0e81eb08d723da80d7cbe9f2390137596cfead83820db53f0674 The package clob-client-sdks was found to contain malicious code. Source: ghsa-malware 2ff610e554b6569926182810264eb97b765d9c2fde7e3a53fc3c8e16388b79...
MAL-2026-1690 Malicious code in chain-promised-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905259914ab893ce8ca6d455af186ca553bb76d253657ea9f38457798519c708 The package chain-promised-cli was found to contain malicious code...
MAL-2026-1685 Malicious code in chai-types (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75b0056e3a13b9c7f97a77ee8351068a9d1a900c5cabd5f42011b31cedf0fd13 The package chai-types was found to contain malicious code...
MAL-2026-1683 Malicious code in chai-promised-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a73df3d15a01155775fd64c754db5ed47ea65ad63281989810ee1f207cd23f9 The package chai-promised-tools was found to contain malicious code...
MAL-2026-1680 Malicious code in chai-promised-await (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4af3ac4bdf4f878612b66ee0cad227e2bef184fe763ff80478fc0905107d3edb The package chai-promised-await was found to contain malicious code...
MAL-2026-1668 Malicious code in chai-as-produced (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8741712e4e467670d7233e9312dc417f809f4f3d3af0a48d31a9693ad1391067 The package chai-as-produced was found to contain malicious code...
MAL-2026-1663 Malicious code in braze-content-card-island (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbb26229041c73ccd4e0f0141472ca96d9aaf14e5b161bed78ba6b487c2d8fc9 The package braze-content-card-island was found to contain malicious code...
MAL-2026-1657 Malicious code in backstage-plugin-wpe-catalog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ba337d37ef9344a2df43beb88ffec3f1061cba440eb4c4ed69798da6f3122b5 The package backstage-plugin-wpe-catalog was found to contain malicious code...
MAL-2026-1649 Malicious code in advertising-podlet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bb234dd090695707ab05d6b4726b89a073ae2f517cad9b2fb7069aa58d08360 The package advertising-podlet was found to contain malicious code...
MAL-2026-1643 Malicious code in @vampirchik147/libxmljs2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f1f47e6141b6c2d1af00b86d33d71cac6c53f6e64f307e1533e4ae108560092 The package @vampirchik147/libxmljs2 was found to contain malicious code...
MAL-2026-1634 Malicious code in @panopto/api-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02e9e606e2aef11de752a18ad63f5772f485bb0fd40f66cc61b2e0f9a5ffe26f The package @panopto/api-core was found to contain malicious code...
MAL-2026-1632 Malicious code in @nxt-costco-com/forge-design-tokens (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86e4556dfaa2a30079bf31edd7c9a378deacc22b763f547a4b825d57945debef The package @nxt-costco-com/forge-design-tokens was found to contain malicious code...
MAL-2026-1629 Malicious code in @legacy-utils/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4026cb40c25024aed536f27fff7b56c83454df35846798e4307e658f23c69dc The package @legacy-utils/core was found to contain malicious code...
MAL-2026-1626 Malicious code in @kui-react/table (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab2473063a85d7353d5d857b5a93b62a0d1d2be81640afc1f8ed809a9382c923 The package @kui-react/table was found to contain malicious code...
MAL-2026-1622 Malicious code in @f5rest/odata-v4-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34696bd2c7207574311745e28bb00c41c683bef6c9843edc69042a47081df10b The package @f5rest/odata-v4-server was found to contain malicious code...
MAL-2026-1465 Malicious code in hariprasath (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b76de996c85f413b2169be46799cbd7dcd1d32a23eb303d0b17ecccae1b10011 The package hariprasath was found to contain malicious code. Source: ghsa-malware df15d2b2f2032416b2715e63515ca04b9bfeb6129516f9fa92d3a633942d07cc An...
MAL-2026-1446 Malicious code in omhcsilence-bails (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f5390575abcab0cfc57edaae4aa14d27eab897c1639fab8a502fcda0760adc3 The package omhcsilence-bails was found to contain malicious code. Source: ghsa-malware...
MAL-2026-1409 Malicious code in darkig (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7589c67c4429eabd010f891cb17f893ee11ec3cb873d4a31095cc3592134f762 Instagram hacking tool that also forces the user to follow hardcoded accounts. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...
MAL-2026-1411 Malicious code in nfd (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 09861068d4a40cdebd80dae1ae4db85b45498bdb1f7f039cf44b33f41e68534f Facebook automation/hacking tool, with a part of its code obfuscated. Given that other packages from this uploader exfiltrate user's credentials, this is likel...
MAL-2026-1281 Malicious code in pyutils-helper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8b1055c03077c874d21f69aa9403cebd070e2b7398e27b44310c977219bc0e7a Importing the module starts a silent cryptocurrency mining in the background for a hardcoded wallet. --- Category: MALICIOUS - The campaign has clearly malicio...
MAL-2026-1257 Malicious code in pdfjs-dist-fourth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcaf355459e8baaef860a557036e51431e6eb6c44dcba0e800579cf978f2f64d The package pdfjs-dist-fourth was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-1223 Malicious code in risk-utilities (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 22f9a9b921e53b4755c41241969fcc8b410b09f29a63ed9c23c5a19c966b4946 During installation, the package starts obfuscated code that downloads and runs remote executables in specific environments. In some packages in the campaign,...
MAL-2026-1104 Malicious code in bubble-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bac16503e5a840ccf7e88977f38fac02affaa1c8eaff7f449b9832fa03cbd0a8 The package bubble-core was found to contain malicious code. Source: ghsa-malware a4122cb6b21018902fe682cf3dd31246d52f8850e8116649894d89df6f06acb2 An...
MAL-2026-1090 Malicious code in isb (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 93750cbddba7897fde1d31836971e11082ad2076012c7caf708980de45827840 Starting the module initiates an infostealer with a Telegram bot and RAT-like functionality and hardcoded credentials. The code automatically adds itself to...
MAL-2026-1232 Malicious code in @schedaero/yukon (npm)
Multiple evidences indicate malicious behavior: suspicious URL, data exfiltration, process exiting, and preinstall script execution. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02868b7ba4a5e5bf754e692e348191e6974f2f707417f20f97b33f172cda4ca The package...
MAL-2026-987 Malicious code in vl-ui-accessibility (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7e52c3145cd55d304bb64380b4ac900f8fcda605ef0d88ad4b445709c1fa6f The package vl-ui-accessibility was found to contain malicious code. Source: ossf-package-analysis...
MAL-2026-983 Malicious code in tensorflow-opt (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 c2197ee3bfb727ff46f407a50a515013ad05c423bfe202eea90eb6b593f08b14 Package is likely a dependency confusion against some legitimate extension packages for TensorFlow but contains just cryptominers. When calling the "start"...
MAL-2026-982 Malicious code in trunket-dev-driver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9ed872a63bcf6182fad3d7b6cfbe87019ff531f1ecff3a511b10371479c79810 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-977 Malicious code in airbnb-identity (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 40e5d276e9f30fb5f1071927366f0f13024da90b79fdfb1967cc5bd6d2330342 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-948 Malicious code in ethrpc-accounts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6372ce82342ae30022a83501fc348d1c63ec3cb27b19dba0678430efdfeeb077 This package is a clone of legitimate eth-accounts. The malicious code is hidden in the dependency, ethrpc-keys, which exfiltrates private keys. --- Category:...
MAL-2024-12375 Malicious code in langraph (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4d1857013d9ca781ba7579d60e20a1ee155ced90eef1e9d99045b8797e3e18be Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-851 Malicious code in python-files-mod (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3f9a5cad398dbfcea1ea0ed1a7b20c678a67941581a4562aa92703ac86ee421a Disguised as file system manipulation library, the package hides an obfuscated code to communicate with a Telegram channel. Though the usage is not known at th...
MAL-2026-822 Malicious code in react-svg-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63577e9faa19bf76dac1f171ee006ed6801a0726d5782ae1246bde01b508a7ad The package react-svg-handler was found to contain malicious code. Source: ghsa-malware...
MAL-2026-811 Malicious code in grokwrapper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2 During importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It's then added to Run registry...
MAL-2026-650 Malicious code in tableapy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7adeff5bc226723e8e3241a36596e3e99094553770deda5e89ac8caf7c0e0f01 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...
MAL-2026-610 Malicious code in snapshot-date (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8e86008d35e5f11e68c465940563127cdc9ba1d4b2963f092914bf8e9ce2587b This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...
MAL-2026-510 Malicious code in radishwxm5 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4cbabb01d98bcad5705b98f5aac22b9d8f53e8c97e2fe5ab8bca66661e6c0644 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-444 Malicious code in terminalbrush (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 35e06fb41f9c1a4f082cf49a72dec89fc5b4d2f6580b97e527d291d50807b801 Package downloads an executable, places it distinguished as a Python binary and starts it. At the time of analysis, the URL was no longer active, so it was not...
MAL-2026-346 Malicious code in zod-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d6e0134575d22df9c8acb633e41aeb44e167203581cee75c81264667e9bdee The package zod-js was found to contain malicious code. Source: ghsa-malware df349fd5990c0cb74fcaa574f32fd30796c00bbe619ee60bd0eac1a658c7dd49 Any...
MAL-2026-162 Malicious code in btcli-security (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a4b868f818b1a81f5fccee1967f70c3ff9d75c218d14ec09882c576a9c2c213e Package clones a legitimate bittensor-cli library and adds a hidden code that downloads a malicious script. The script then downloads an archive with malicious...
MAL-2025-192685 Malicious code in hooktest-fin (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 87e6fba5c0ac4b5359cb360a5dbf68404d0b8559bd94a9f4c33fdad09559b241 During installation, a script to execute remote commands through a Discord bot is installed, ensuring its persistence over reboots --- Category: MALICIOUS - Th...
MAL-2025-192679 Malicious code in system-health-check-test-unique (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 10bfd6e986187675dd7d7e3a8f860807e408fd6a91694ca0e0128be83fa8fc47 Importing the module exfiltrates content of /var/www/html to a remote host --- Category: MALICIOUS - The campaign has clearly malicious intent, like...
MAL-2025-192550 Malicious code in fruit-malicious-xml-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c330d59c7529d320701e6ccf11a655110e1aeb7c9ad5d15c34ba10941c6343a6 The package fruit-malicious-xml-parser was found to contain malicious code. Source: ghsa-malware...
MAL-2025-192467 Malicious code in gxzip (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8e0dd8700d5267b8d9bbe270798b11d2250761decf1de89249eab6d90a29080c During initialization of the archive-support class, the package starts code from another file and downloads multi-stage malware --- Category: MALICIOUS - The...
MAL-2025-192438 Malicious code in synium (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 85fc917c33d970cb3365ff112f788b229638b757c32eaf99ba1054c8596298c1 During import, package exfiltrates specific global variables to a remote target in a way typical for infostealers --- Category: MALICIOUS - The campaign has...
MAL-2025-192436 Malicious code in jsonschema-utf8 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 61bf4fa82a7c398e580d547d641bc19e3b16ba446191da04f39dcf9cf9a41eab Package clones a popular package loguru, jsonschema, .... While it claims to have some additional features, the real change is an added compiled native library...
MAL-2025-192351 Malicious code in evil-rce (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 74a74a4133ed8082eba8452bb59a82dcf6975e1e8c4d6630a47088c17d6b6cca Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce...
MAL-2025-192338 Malicious code in elf-stats-shimmering-toolkit-483 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa849828ae330627573a02a9cfec420e470cf5dcfa587e0080e3db4105f31ad2 The package elf-stats-shimmering-toolkit-483 was found to contain malicious code...
MAL-2025-191557 Malicious code in codemirror-5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788b98a42ba1658c92e6e86494ddd747ab154a01be456dfe9656760bd264fe46 The package codemirror-5 was found to contain malicious code. Source: ghsa-malware 0803dd9e41e867827659b46d2934d1a9700667e0f731dce60093ab5f9457c07f A...