MAL-2023-1239 Malicious code in mongoose-geojson-schema-2d (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f64dbcc8b994e165e387b83aad34a6af319aafa0fe13b67eb52d8c5fb286e34f The OpenSSF Package Analysis project identified 'mongoose-geojson-schema-2d' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-2692 Malicious code in cxfreezepy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 98b9fe0f574ed33e0a4096ba8774936c73969493c1621244334a739ef4f94f5d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-1384 Malicious code in os-numpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 40ad87c585abfe0e853406f3417eab643e74d78e36679be13bdc5445899d5397 The OpenSSF Package Analysis project identified 'os-numpy' @ 3.19.4 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1393 Malicious code in pylint-beautifulsoup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c3646b7e949a863983491259c105cde8b1ff0229781276a5ea22360c75440c5e The OpenSSF Package Analysis project identified 'pylint-beautifulsoup' @ 3.12.3 pypi as malicious. It is considered malicious because: - The...

MAL-2023-1389 Malicious code in pygame-install (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93390eea0977ef15ff0c7413e64df5bd99497ea76e9238097ee0b6f4b9862fdd The OpenSSF Package Analysis project identified 'pygame-install' @ 17.14.20 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1390 Malicious code in pygame-print (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 66d8d06a549ba9055684a0ad39301d7fec720528e8a94e657a9a9de90443ca1c The OpenSSF Package Analysis project identified 'pygame-print' @ 15.0.6 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-1366 Malicious code in guiconsoles (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 24a3798623a3f68e4c418540b53aa81d86785aeb5618a02914aa14be4c4311ba The OpenSSF Package Analysis project identified 'guiconsoles' @ 1.0.5 pypi as malicious. It is considered malicious because: - The package...

MAL-2023-8591 Malicious code in pywool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1ba602a97accda8e614fcf38d1af1cb7f1878bf2bd450b21f1be16a4c260123a Malicious packages campaign targeting developers, payload is hidden using Steganography, exfiltrate host information...

MAL-2023-46 Malicious code in @nokia-csf-uxr/csfwidgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39bbff0400a8d8025c9c214e1a4412729bd69e23c231e3307d61d05b54f8eb72 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1110 Malicious code in adityan-pwdd-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 674ca0f770a4ea3dd88fa7978e7f082c0baa7b7eaa7f761e364d1c8bccfc3664 The OpenSSF Package Analysis project identified 'adityan-pwdd-test' @ 3.0.8 npm as malicious. It is considered malicious because: - The package...

MAL-2023-4330 Malicious code in libpipultravirtual (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7fcc0ea3b75f3b40abcfb64156cfe1244cf729c1511a1e325ca450c73a7ee9f4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-527 Malicious code in ing-orange-lu-luxtrust-oaw-mobile-authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c47e898a8d28683ffbebd031a0d10c1a1d610661c8b876689bdc85931ceda9f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8009 Malicious code in ajaxmanager-custom (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cbfc18e18de3ecf81548e9fff07c310df0c09ae04271fbe4e2f3e6872af6c549 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-4635 Malicious code in libvirtualsplitstring (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 12835d55612081a12b0190ee5d1dbe4b90dd33cc79525e9243fc956ed45ed66b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5238 Malicious code in py-intelpingvm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 031c07e21b938012af8f66916bab9194cbc2ab63012f704218f48a86ffbeea02 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5678 Malicious code in py-studyvmpyw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 33426fde62ec7abad65c46ecec38eeb6ccf617f113b948e5853f00c77d7802ad EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6625 Malicious code in selfsplitreplacecraft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7df84fb9d259d10ace99c1e37391c7d1a2a641f28aa55e746f5bca57e8b03488 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7325 Malicious code in tppaypalproofre (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c76bccdee392d444020b6197e463ac87a45854d2454f4a7e4b58c42568c78891 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7303 Malicious code in tposintadget (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 09d7c9df1859042d6bf492ed412327a819ba78649e3175f7c9f05953d096b30c EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4607 Malicious code in libverhackedhacked (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fff3c918183b7b83234be4059b10a657ad7ccf188a4354f328e49eb9f120d34c EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5103 Malicious code in py-encodevirtualgui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 936dc38858ffbb3e9dfcf5c63575092270fed7b32221a005a15dea78ccd45bc1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7714 Malicious code in tpvirtualramget (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e1d5d9368eb71fed1c146965eb23d9fc0f5eeda9d35ab57a5342f84481e6c5a7 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4539 Malicious code in libstudysplitping (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx bd8fb4d1458c705879a5ade12321d358b9a8caf6e5656172e8ca5260de3a3496 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5167 Malicious code in py-hackedreplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ce41dd30a699a03e340ed9e8ab8258eedfc8b94ae6a7a62573bc718d759b4c78 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6827 Malicious code in strreplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 796d32fda5954c18fa1e704923323db7f7fa0a79c7e6cffd1e810c657e6fbd34 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4810 Malicious code in osintsplit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 996360312d49944c5ceac16259b24a749207fe37c14ddd8a02df098659c0f7bf EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4844 Malicious code in pepultra (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c89d471f3e9da7d239933047898807dc2d0143a2bde481a033f648635b037ff9 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-3667 Malicious code in grandurl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c79a2a8050c68b81599a731575a18aa80a6a035a57fe944a6d3c69e7841f7b60 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2001 Malicious code in prompt-toolki (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx acef1e4de1031517c9ec95e1bd0a0fcbdc570dc0bd4598502414eb642ef81936 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-2183 Malicious code in requuests-toolbelt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a73ffed20312c26aec693b6569e9eb3fc25abd0293a49ce01d24ecaef04f272c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

MAL-2023-34 Malicious code in @chegg/wtai-upload-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed3e4233e6f2d188d7f2bab940bf8574017cf73a97b440daddc7f4e3176075a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-461 Malicious code in fronton-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d44f273938402bf07c8942f200cf613694ff6b357a5800e67b88a47dc620f019 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-264 Malicious code in django-template-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a4058c9a8f986347dd22fe461b25c3ae525959ed7a05da257b79c7aa4d9aad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-995 Malicious code in yandex-yt-yson-bindings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef8f5064d17e16f308f05ff124d515f803d1acfdc65fa58b4c26a8ac52041b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-932 Malicious code in alias-for-vue3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d454b09899f2b5bf09380b8c0ec207d7347f09b5121d3b77e0d9d6e255e86dac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-220 Malicious code in @dydxprotocol/solo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 414b7a58031d755b2ab4f51d6bfc4bbaf5dad684161eab9b2d1062b8d4ce22df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2831 Malicious code in eslint-plwgin-stdnard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e4bd8aff7beb430ed17e653b5a5617bd79482688ae7947419d4faf2bd38892b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2786 Malicious code in es6shsm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 532e251435e5aa43412f0a3d67927aad3b0df8a7a31d174bc651cda37d917934 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1 Malicious code in rustdecimal (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e33f42f05c60c6d9f9297bae15a43d6c445e2ad0fd67fa4ef144e5cc79d09c7 The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained...

MAL-2022-3423 Malicious code in gorgias-api-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3752bead049fa8a0c9a1ac58a30aec2abe204a01e1a2cb349475d3268d082eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1502 Malicious code in bender-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b1b3d673f58d56435e2247ec618209b57a3c23bacdff658646c24daa2ff8ab1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4476 Malicious code in mapbox-studio-pro-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe184c4c51f61f287036c394d47e1acee2fa5b397efde30a69df40abfe963bfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6076 Malicious code in sharded-redis-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d865c1c6b738fef08ee9e527bb7d993b8641f48eecfa5a0f06e4ba946a89a2a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4256 Malicious code in landing-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 078d7c5ae32c0bdefcd58f8357842e4b29a7a8097ec0ccd49f8cb673554cfb07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2631 Malicious code in dx-devsite-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94d8e93f1fe2cd310bb5359e393df7bf057fae4e9a8bdb71bbcf18dbebb8d5d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6899 Malicious code in vcpkg-cmake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80593ffd7d75714d0af2374df6c55cdee9641b04d9d96f9d909d1417f6384604 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2091 Malicious code in com.unity.modules.unitywebrequesttexture (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0e54f4a9736ea22212cfa0acc6b8ce58d08a9a7f05e01e95cc44b600cc77a59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-623 Malicious code in @tampmd/hyperion-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e05729670d6eb435beb0758aa814a385654d4a70178bc1f6a9936785f9aac116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-811 Malicious code in ac-animation-sequencer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7595dea4b4bf14edbd22f889a9d64c68692b172c8ffbbc5684b3903c81aeafd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-763 Malicious code in @xvideos/facade-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5feb9ec8e74abdbd32d92e6275ffeac517d4a67c4186446364de5ad5b10c80fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...