MAL-2026-18670 Malicious code in @axo_cuy/baileyss (npm)

@axocuy/baileyss is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

MAL-2026-18690 Malicious code in lunaaa-baileys (npm)

lunaaa-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/messages-recv.js, lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query an...

MAL-2026-18699 Malicious code in wiselllx (npm)

wiselllx is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to th...

MAL-2026-18679 Malicious code in @monze1239/baileys (npm)

@monze1239/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...

MAL-2026-18299 Malicious code in claudeopuseni (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d On import, claudeopuseni/init.py invokes boot.check, which issues an HTTPS GET to https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json,...

MAL-2026-18300 Malicious code in claudeopusenifile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 051daf7dfb8c28210996afbf561646b38781f563483e6c2e7471add0a6021885 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds...

MAL-2026-18298 Malicious code in claudeopusfile (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de2f0d45d8a2c0489d082d86a91c63fc5cad53f891b3dd1e976cd7479344c65f setup.py imports claudeopusfile.compat.ensurecompat during pip install. compat.py constructs the string 'exec' from a chr-code tuple...

MAL-2026-18297 Malicious code in nebulallm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50e0ed125f08fd7743ccfb40590c24304b4731f6a99b69bc553b5bb8b7e57fc6 During installation package first downloads a JScript script, which then downloads the next malicious DLL. --- Category: MALICIOUS - The campaign has clearly...

MAL-2026-18296 Malicious code in zagents-message-bus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 177a91975e11b9b3afbc5089dfc7e4c4fdae1cb05f8307f397956c675533f0d8 pypi package zagents-message-bus is published at an implausibly inflated version 99.99.100 under an internal-sounding name, consistent with a...

MAL-2026-18294 Malicious code in @capsense/ccx-welcome-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060 The package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks preinstall, install, postinstall to run...

MAL-2026-18295 Malicious code in @capsense/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8 @capsense/[email protected] is published to the public npm registry under a scoped name at an implausibly high version, a shape used to override an...

MAL-2026-18292 Malicious code in event-bus-lite-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721 The package ships a binding.gyp whose target has type "none" and no C/C++ source files; its only purpose is a GYP !... command-expansion that runs no...

MAL-2026-18293 Malicious code in w-mousekey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90980104a84f52c4a98cc74642b9ff7a6c0556771e20b6f6eaeb96eb876cd979 Analysis of [email protected] produced no indicators of installer-side harm. No install-time or import-time execution of attacker-controlled code, no...

MAL-2026-18290 Malicious code in react-native-bright-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4208eebeabe05114e68e0b4abf11c9ff176594200c28400fe5c82deb3a5c8f55 The package declares a preinstall lifecycle hook that executes canary.js on npm install. The script collects os.hostname and an install timestamp,...

MAL-2026-18288 Malicious code in jshelperdependenceny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc4d19697f4104351bb25b7e568018ec6ed85d626b7265fb4b9682ae12183be9 npm package 'jshelperdependenceny' is published at version 99.0.0 with a preinstall banner stating it is intended to shadow an internal v1.0.0 packag...

MAL-2026-18279 Malicious code in @fmr-ap153177/apex-kit-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff7b14a37bdf740ac9f0e4c8978c2c577d39f04d7b897a5d698cbb220ecf3c9a package.json declares the sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.1.tgz...

MAL-2026-18281 Malicious code in @generic-means/ing-feat-scanner-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7053eaf141232704108519a3b3e7a0f1197d9eaabfa9fd3f4ff56ae9f753d763 package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.3.tgz...

MAL-2026-18278 Malicious code in @factoryz/apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad The package ships only an empty stub module.exports = and a manifest whose sole dependency ltidisafe is resolved from a hardcoded off-registry HTTPS...

MAL-2026-18284 Malicious code in @jm-telefonica/multibrand-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ef565c5fd4b4baa7e0bff888cf34107fa8a9385932195fa4fd90ad39f250927 package.json at line 9 declares the sole dependency ltidisafe as a direct HTTPS tarball URL...

MAL-2026-18285 Malicious code in @postex/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fb98ad3575267cc8fbf617fe6a17000ed10df97d39710f4b7aaddf7225598d7 @postex/[email protected] ships an inert index.js module.exports = and declares a single dependency ltidisafe whose value is a bare HTTPS tarball URL...

MAL-2026-18291 Malicious code in sc-hydrate-carousel-price (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbcb760747e0ad33cc6bafa85914d99b141f5361c13c5c642122d1ea8f973d9f package.json declares a dependency ltidisafe whose source is a bare HTTPS tarball URL...

MAL-2026-18280 Malicious code in @futurae-public/adaptive-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18526e44113025f1e08a31eb237515c63ae912a6cfe82bec37c14895f4f23178 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.2.tgz...

MAL-2026-18289 Malicious code in paychex-pdftron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3 [email protected] ships an empty stub module.exports = and declares its sole dependency ltidisafe as a bare HTTPS tarball URL...

MAL-2026-18274 Malicious code in @ppa-web-components/ppa-headerfooter (npm)

@ppa-web-components/ppa-headerfooter is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.0, 2.0.1, 2.0.0, 1.0.1, 99.0.1, 3.0.0 has a postinstall scri...

MAL-2026-18275 Malicious code in @ppa-web-components/ppa-hotel-collection (npm)

@ppa-web-components/ppa-hotel-collection is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.1.0, 1.0.0, 99.0.1, 2.0.1, 3.0.0 has a postinstall script...

MAL-2026-18272 Malicious code in @ppa-web-components/ppa-banner (npm)

@ppa-web-components/ppa-banner is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0, 1.0.1, 2.0.0, 1.1.0, 0.0.1, 2.0.1, 1.0.0 has a postinstall scri...

MAL-2026-18273 Malicious code in @ppa-web-components/ppa-builder (npm)

@ppa-web-components/ppa-builder is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 99.0.1, 2.0.1, 3.0.0 has a postinstall script th...

MAL-2026-18287 Malicious code in @ppa-web-components/ppa-searchform (npm)

@ppa-web-components/ppa-searchform is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.0, 1.0.1, 2.0.1, 0.0.1, 3.0.0, 1.1.0, 99.0.1, 2.0.0 has a...

MAL-2026-18286 Malicious code in @ppa-web-components/ppa-navigation (npm)

@ppa-web-components/ppa-navigation is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.0.1, 1.0.0, 2.0.0, 99.0.1, 3.0.0, 2.0.1 has a postinstall script...

MAL-2026-18271 Malicious code in fontus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5b8b4484126f787f9917d91b6815927146a308f64bfb852c57f5d60bf4bfbb Analysis of fontus 0.0.3 on PyPI did not identify any code paths that exfiltrate installer data, execute attacker-controlled payloads at install or...

MAL-2026-18258 Malicious code in insta-reel-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc584c5e885d66c7d3e895a467192ddd7a40082a2fe2df9ad45d8835ba65c4e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18260 Malicious code in ionic-sound-cloud-loader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1fdd1acea61b27d664ac4012dcc63f8a5525fe7893a3f012b8a04bf00596b33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18257 Malicious code in insta-api-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6451b5d95d51aa4063e15551a18c1305088f92597bf3a7e47bd18472a81d9855 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18267 Malicious code in sound-cloud-loader-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fd8d35927bc622270dcca94349a58c1f9daf31ebeb6bd4c8fc784cd140cc263 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18268 Malicious code in tiktok-video-scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ef8afdfd46def73ea112fa0024f94e41f206305cf9334662735958c05ccfe99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18261 Malicious code in ionic-tiktok-scraper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81665bdc2eec89b96d3b0ce247657c1ad75f497503347b8c35c65d324e99a389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18253 Malicious code in appit-cordova-admob (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c43e8d1cd94e817a763aa22f3edb86e232a3c4ca467af0c8d77cda9b3b03c3d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18266 Malicious code in redis-dumper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c3ee8b960cc4d59eff195c1ddc79224b61178479a16026c47dc5cb79cb93cbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18259 Malicious code in ionic-insta-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 407c310ce45465666130259c09efcd3fbcb31a3d0173587bd2c4db6a078cc70a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18263 Malicious code in ionic-youtube-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c551ccf6ad7f2689c8e83cd054ea50278c224f50d1f37dc0285a3da31331dbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18262 Malicious code in ionic-youtube-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c081308db3c1e903e04a99672621d70a549e82da4baa7e7624d3960048d93e63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18270 Malicious code in youtube-search-without-api-key (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64255a9b30bfd083ac86612f2d7307de45dc83a57c42caf459cfb8df21dc2bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18264 Malicious code in ocsp-hashes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5167b67fd13cd4c8c6f63298909e9e4b532cae03035e5158629eaaa355cc540 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18269 Malicious code in youtube-info-streams (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d38f2ba6def3a037f621b617a0823144c52043e6adc1b22f2e81eb7aafc5ae11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18254 Malicious code in appit-cordova-plugin-ionic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ca4bb7b12ff9e72819f551c8252a855a7500368c07445e10661aa67cd7792c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18256 Malicious code in cordova-plugin-geofence-appit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d6df6a389ad760629032dd0d4208662693ac60ebca2ff2b53ffbdf5f464387a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18265 Malicious code in p12-pem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c50c1679b0617ad231d0e8aaf2c111ab57f909dff3af9e1b628169aba167381 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18255 Malicious code in cert-infos (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9c8351a95953b95817bd6cc206618cfb83676e664b8ea2d67035b17ddb21079 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18252 Malicious code in @eforms/forms-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e58d3810346fb211fd7ed78e8df88c774a79bb079537e10cd30baa26e5ef4740 The npm package @eforms/[email protected] is a scoped-name dependency-confusion lure with an inflated version number and an empty index.js stub. Its...

MAL-2026-18276 Malicious code in @drone-js-ext/core (npm)

@drone-js-ext/core is a dependency-confusion package: it squats the @drone-js-ext scope, which matches a private internal package scope, and was published on 2026-10-25 in versions 1.0.0, 2.0.1, 3.0.0, 99.0.1 up to 99.0.1 so that builds resolving the internal name from the public registry install...