239514 matches found
MAL-2026-1688 Malicious code in chain-promised (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fd6ee3247632a88a25b8059314727f1757ed1163081b133945fbe4af59e5d28 The package chain-promised was found to contain malicious code...
MAL-2026-1686 Malicious code in chain-argon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ee1203bf0112eb0f499bffaaaaa84264b875f83e282b54ec6749fe9230baf2 The package chain-argon was found to contain malicious code...
MAL-2026-1685 Malicious code in chai-types (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75b0056e3a13b9c7f97a77ee8351068a9d1a900c5cabd5f42011b31cedf0fd13 The package chai-types was found to contain malicious code...
MAL-2026-1678 Malicious code in chai-conf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77f30f15e3e699b15abf8ebd6bac4a15f8032d0411ab2b445f056ff0228b844 The package chai-conf was found to contain malicious code...
MAL-2026-1668 Malicious code in chai-as-produced (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8741712e4e467670d7233e9312dc417f809f4f3d3af0a48d31a9693ad1391067 The package chai-as-produced was found to contain malicious code...
MAL-2026-1662 Malicious code in blob-internal-security-test-f63eabf7 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e74309111e07d1757fef6d6a253d000339f2215e3166990d4e64964d4ec3d803 The package blob-internal-security-test-f63eabf7 was found to contain malicious code...
MAL-2026-1658 Malicious code in bcp-security-update (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d8a18510bbeb71543526f0ef059351a12f97a1addd3c8664961231a7e862bf The package bcp-security-update was found to contain malicious code...
MAL-2026-1659 Malicious code in bcp-security-updates (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ae78f7be7d7bfc2a5c001fd71b000a7cfe42a5f8c6e7d2b828ec3f143d26319 The package bcp-security-updates was found to contain malicious code...
MAL-2026-1653 Malicious code in align-configer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a76e6de932ec68131ed43e8241b4a224deb6a87a78c4d6e2bc641680dc52e70 The package align-configer was found to contain malicious code...
MAL-2026-1652 Malicious code in alfasec (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35524fe277f853c2365b7fdeeb88c494ecd1f85436077d4692a92de3fdfe92a The package alfasec was found to contain malicious code...
MAL-2026-1634 Malicious code in @panopto/api-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02e9e606e2aef11de752a18ad63f5772f485bb0fd40f66cc61b2e0f9a5ffe26f The package @panopto/api-core was found to contain malicious code...
MAL-2026-1281 Malicious code in pyutils-helper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8b1055c03077c874d21f69aa9403cebd070e2b7398e27b44310c977219bc0e7a Importing the module starts a silent cryptocurrency mining in the background for a hardcoded wallet. --- Category: MALICIOUS - The campaign has clearly malicio...
MAL-2026-1223 Malicious code in risk-utilities (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 22f9a9b921e53b4755c41241969fcc8b410b09f29a63ed9c23c5a19c966b4946 During installation, the package starts obfuscated code that downloads and runs remote executables in specific environments. In some packages in the campaign,...
MAL-2026-984 Malicious code in myasicapi (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 62067570b5217e75a025ba09e5e4f0d059439d8a7d30e056bdd501fe97e4f844 The code and related Github project promise to monitor hardware cryptominers. However, the code additionally hides two malicious capabilities functionalities: ...
MAL-2026-982 Malicious code in trunket-dev-driver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 9ed872a63bcf6182fad3d7b6cfbe87019ff531f1ecff3a511b10371479c79810 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-977 Malicious code in airbnb-identity (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 40e5d276e9f30fb5f1071927366f0f13024da90b79fdfb1967cc5bd6d2330342 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-948 Malicious code in ethrpc-accounts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6372ce82342ae30022a83501fc348d1c63ec3cb27b19dba0678430efdfeeb077 This package is a clone of legitimate eth-accounts. The malicious code is hidden in the dependency, ethrpc-keys, which exfiltrates private keys. --- Category:...
MAL-2026-851 Malicious code in python-files-mod (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3f9a5cad398dbfcea1ea0ed1a7b20c678a67941581a4562aa92703ac86ee421a Disguised as file system manipulation library, the package hides an obfuscated code to communicate with a Telegram channel. Though the usage is not known at th...
MAL-2026-610 Malicious code in snapshot-date (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8e86008d35e5f11e68c465940563127cdc9ba1d4b2963f092914bf8e9ce2587b This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...
MAL-2025-192608 Malicious code in f5-logger (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 dc7c52cb0573811c8391ab93a1a04c99826ebc3fffb98aa82cfe8deb4e58fc1d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2025-192386 Malicious code in telcoo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 c96937a82adce2ecc6628245fd858587131511b4145c04f577ec25d8fa846577 Running the module starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-12-evil-rce...
MAL-2025-192338 Malicious code in elf-stats-shimmering-toolkit-483 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa849828ae330627573a02a9cfec420e470cf5dcfa587e0080e3db4105f31ad2 The package elf-stats-shimmering-toolkit-483 was found to contain malicious code...
MAL-2025-191662 Malicious code in starexx (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-185689 Malicious code in avior-sails-tethys-kronos (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9f1f7e5c6b1321a8419f9234c803b8bb420665ce0d19a09ced27ba87b7fd2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186029 Malicious code in cat-compile-analyze-deploy-cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9514ab2e174c3c41eef9112756070b30355f2acf2e0db624c254b0fbd779b0d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-150748 Malicious code in @miptaa02/ipmb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2301247a84bddb2993853e341d1d63bbfc7745325e9d5f314c652a424e02f198 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-108224 Malicious code in royal_raccoon_0xrequest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f001a1f4848925e1cf9fe66215b7a1173adb7caf8cb6dc28fce21eee473c083 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-46987 Malicious code in arm-package-deploymentscripts-2019-10-preview (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 036de74aa3f36e7c65b0ae918b5cbc8dad256bac711320dbded5935ef0d48657 The OpenSSF Package Analysis project identified 'arm-package-deploymentscripts-2019-10-preview' @ 8.0.1 npm as malicious. It is considered...
MAL-2025-10946 Malicious code in @zalastax/nolb-co2 (npm)
The package @zalastax/nolb-co2 was found to contain malicious code...
MAL-2025-38247 Malicious code in versalink-bmp183-device (npm)
The package versalink-bmp183-device was found to contain malicious code...
MAL-2025-37319 Malicious code in turnip-gazebo-mf7i (npm)
The package turnip-gazebo-mf7i was found to contain malicious code...
MAL-2025-11758 Malicious code in @zalastax/nolb-graphql-j (npm)
The package @zalastax/nolb-graphql-j was found to contain malicious code...
MAL-2025-5001 Malicious code in ripe-grs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a9dcae56aa553fbd3ac26d68ec192342012f6cdf9d82443a1cc08f76d037c1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-191884 Malicious code in tableausdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2facdadd713d6c1751cf3c2ca1e5e76f1cb367c5d30c3f06fe73808c6a08fca3 While described as telemetry, importing the package attempts to send out some basic info as well as quite sensitive environmental variables. --- Category:...
MAL-2025-3820 Malicious code in baby-electron (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 598fa750ced56976e16940829f016c95ce72e423a41d8875aef222ea1b85e54b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3742 Malicious code in document-inference (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0519099776ddb5cbd1778fa5f043a1cad34d94d5116ae895120aba38608e7eb0 Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...
MAL-2025-3701 Malicious code in @walmart-dataventures/integrated-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6500cbbfb04c2cba829725a6851746577238ca39c724e4030421834285a958fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-191816 Malicious code in pretty-cli-logger (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 94cd11911ce2a0937d9e56087ce9487db18da5bb20df7f1f8948f8356d65c31d Contains an obfuscated code that will download and run a remote script. At the time of the analysis, the remote URLs were delivering empty results --- Category...
MAL-2025-3375 Malicious code in afterlogic-aurora-platform (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-191723 Malicious code in fastertelethon (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3ccfc281c2541df7e1354e6de8c64624fdc75dcc229d33962b171b0a95087edf Clone of Telethon package that exfiltrates credentials. See client/telegrambaseclient.py L608-626 exfiltration function and client/auth.py L163 usage. ---...
MAL-2025-2930 Malicious code in agents-kit (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-2397 Malicious code in oauth2-paypal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cc95085eb1819e853bafa9792a2e3d1b7b761fd85657e25b110586cbb78d997 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2175 Malicious code in hookform-resolvers (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c03aa7176706f7dee9f4c1c8f7c4d645d4345a2a47865b7924eea6e8b47a8101 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-191721 Malicious code in enumer-iam (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8062489d0fe9ae58c1937e4afba7f0f3adfbd507e07dd81bb9450bf7f58c6943 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...
MAL-2024-11688 Malicious code in replication-delay-client111 (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-10308 Malicious code in vpsnet-website (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a6306e16dc768df2420085aa5f4943c50eb1d96ddd9040f840df1b8f7b256b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-10301 Malicious code in @lottiefiles/lottie-player (npm)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security faa879b0fa360852899250846599b4b81d442b942d5e4fec4101044400272af1 The NPM package @lottiefiles/lottie-player had unauthorized new versions published that contained malicious code. The malicious code...
MAL-2024-10277 Malicious code in react-native-blue-crypto (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25cdf24ea56c6768c56579fca642bb9bf9510233ad5c87f48f9ec0cfc336c8c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-9432 Malicious code in atg-superagent-retry-delay (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 75f0747e74a5e0a7d519918b8aceef9e8f4f9eaa0ad1854c1954276bb1c5166c The OpenSSF Package Analysis project identified 'atg-superagent-retry-delay' @ 100.100.100 npm as malicious. It is considered malicious because:...