MAL-2022-2957 Malicious code in f5-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 064c3c3f756de9a0879182ceff2fd06c93793cfd340c7158af0616292b07afd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4891 Malicious code in node-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98c05fd352e2473c2e02bab12ddbc07d7a6a38a346c7962640b31ad91fdb1488 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4476 Malicious code in mapbox-studio-pro-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe184c4c51f61f287036c394d47e1acee2fa5b397efde30a69df40abfe963bfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5145 Malicious code in ota-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b649de88a8d4cf275fb965bdcb313788f4c6d62c0744bcfd2a09442bc022259 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6076 Malicious code in sharded-redis-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d865c1c6b738fef08ee9e527bb7d993b8641f48eecfa5a0f06e4ba946a89a2a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2607 Malicious code in duckduckhack.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0052ff314b9a16d3e634bfd02296d99e2d3dccd151fc048b3b569b41f84d5185 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6190 Malicious code in sncicd-install-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9077b8460d852a9b8afdc2a831fdb0f74e227b48f17f85ddb7ee0da67efa489c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4256 Malicious code in landing-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 078d7c5ae32c0bdefcd58f8357842e4b29a7a8097ec0ccd49f8cb673554cfb07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6899 Malicious code in vcpkg-cmake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80593ffd7d75714d0af2374df6c55cdee9641b04d9d96f9d909d1417f6384604 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2091 Malicious code in com.unity.modules.unitywebrequesttexture (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0e54f4a9736ea22212cfa0acc6b8ce58d08a9a7f05e01e95cc44b600cc77a59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-623 Malicious code in @tampmd/hyperion-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e05729670d6eb435beb0758aa814a385654d4a70178bc1f6a9936785f9aac116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-266 Malicious code in @fbsystem/figma-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffcdcbc9429c0fa805533c9d10c14de74d0e13ff69d006e033802a11ac00733b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5943 Malicious code in sbb-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a33d562d292f4f9490f63efcfa905adb29084516d148a57d0052a57feb01582 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1678 Malicious code in breakout-chat-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d8e13b6a2b5cc5f8e33630acfd72933e8c38a79591e01e7d2104e695661e9c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3738 Malicious code in hypercore-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41ad55ac1ce974e546de492e35db0b27f3f3e4e28404c6bdf3311211a2c58be3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1301 Malicious code in azure-communication-identity (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fce91f9bdf08c4b0fc0a41b7d81163d195792e05edbe2d2f8bd0164ff9a05fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5281 Malicious code in perf-data-tables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dbafd7f735f6fa5bec3af236673c8d99293ed8731c9e57fe12120420d23582f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1307 Malicious code in azure-confidential-ledger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 990af1e5ea3a4d642497c5f273b8dcebb97f2f5b201295507b68326d1b424b52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-675 Malicious code in @twitch-easymode/endpoint-service-loadbalancer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1363444d8b414cabc8b2cf9220bc4c1dcaaed9d95e795a6ccf06ee814a98b0c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-662 Malicious code in @tinkoff-react-bui/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24f7ab4d7d2586559c337934afd7370495bfad3915fbdc7ce528c06666a8101b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1615 Malicious code in blockchain-wallet-v4-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a89d991ea9a446ae4d3d5807de7e61326972d6c0bd7e0ab2b217118d78c06be5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3171 Malicious code in free-fortnite-skins-verify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a36b3677b70a09c6c24c79463b185e1111dc67b9cddd4dace6b9fc0efabc246 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3155 Malicious code in free-fortnite-skins-fortnite-skin-codes-2022 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf05b9e8ed7f0a9a9b9d9d14a47a5ef04e0f916a57dbdaa467d621a96e5b5c92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1715 Malicious code in buffer-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90e069e0b257c2c44767bc83c877dfad638c54bed27449cb150292068db051c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6911 Malicious code in vgs-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea7450a9256eaa2a5b3697fa941aac508944ea795e005119495b21835bbe195a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3306 Malicious code in gd-garnish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c778e61ec4891f2f368b6d02a96722f235bff111f06041dd77b2031b9859724 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5036 Malicious code in oh-my-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e4b827f2db0aa6d95ae246696f5d66665a7017fc655274fc98c6f3e38f78e8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1624 Malicious code in blockstream-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ccc10b4cd514036e391d9b89e7ff3b26cb80f16153487401277913370054670 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1234 Malicious code in azure-api-style-guide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 257d088a2c56246e87ea0068e7e5ffa617d5f06a13dac71c7aca131ab34dcf04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5373 Malicious code in plugin-transform-react-jsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f27c2a663077678179b48cd4851aa8b5aa144a1d4ef1e3bb2cf05526d0b1c7c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7256 Malicious code in www.podium.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f758b50ddd97444c80316f4016410c194b9b0c3bcffdc366146ae2a5824673da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5707 Malicious code in realtime-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53389921842257e5cac4021b62a872f18768a7c49183c56d80628379e3b4f52d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-375 Malicious code in @kaspersky/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 353c3be162a0520ec9a4097a45b0b3df2fc85b4ac6993fc40cca5a13708e3e4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2869 Malicious code in ethers-js-snap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fed39a2c0c5817dd6ae76956a74c435c13481436cac3eb9d117857ad9be21af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-607 Malicious code in @spinak/iac-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77099501462f80e29fcba9337b4c51a78859cfed8347211f50acbafee737a3ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7433 Malicious code in equests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b07d61adac5cc418902b2b527453dcd02eacb4411a61ea7456c8a9546479e59a Malicious packages typosquatting the popular requests package. payload execute a cryptomining malware...

MAL-2026-17663 Malicious code in mfasolver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...

MAL-2026-17642 Malicious code in personio-pipeline-projen (npm)

personio-pipeline-projen presents itself as an authorized dependency-confusion proof-of-concept; the evidence does not identify a copied public package. Its preinstall hook runs on install with node canary.js. The dependency-confusion probe encodes the installing machine's hostname and username,...

MAL-2026-17626 Malicious code in serpacksven1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d4a6a2715973b427bb0aa2b7a493ca711b7f16b5f47f90062edf790e0186a6 The tarball ships no JavaScript — the declared main: index.js is absent — and contains only 10 byte-identical copies of a PowerShell dropper under...

MAL-2026-17606 Malicious code in lighthing-invoice (RubyGems)

RubyGems runs this gem's native extension script ext/lighthing-invoice/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17339 Malicious code in reactjs-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...

MAL-2026-17199 Malicious code in scrapetools2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233 scrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways eu.orbitor.dev, dget.top,...

MAL-2026-16424 Malicious code in @wizloft/harness-cli-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f530bcd1820c18dbf9109139f6895ba89b5bec5b18ac374b85398844c0eabccf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

MAL-2026-16242 Malicious code in trongappy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145727605bb141edc0fa9697253b211a1b0e467db2a484a2cedd163bcc6df1b7 The package exposes a single public function permprivatekey that POSTs its privatekey argument as JSON to the hardcoded URL...

MAL-2026-16241 Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 486630eaee2b9eb50d03d73886a14b7249b0c28fda2cb3f6a13565c8cd38a9bb pypi package rak-lab-yoav-orca-zrktd2cp5hjmo4x7 version 9.9.9 ships a setup.py that, during pip install, reads the DEPLOYMENTTOKEN environment variab...

MAL-2026-16159 Malicious code in dilxztech (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16154 Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

MAL-2026-16200 Malicious code in @zaka13/thing (npm)

@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...

MAL-2026-16070 Malicious code in @fyxzpediaa/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0747ec3c1ce519798cac2e89f8ec1e1532d428355a13929f0176a11d77a2b175 This fork of Baileys injects a covert remote-directed action into the WhatsApp socket. On every WebSocket connection, socketConnect reconstructs a UR...