240368 matches found
MAL-2026-18152 Malicious code in acousticpack (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c846898be0d2a1d2117385e5a45262bb719ee6aab9dc85dfe75b503f074540a Analysis of acousticpack 0.1.0 pypi across 10 files produced no indicators of credential access, outbound exfiltration, install-time or import-time...
MAL-2026-18139 Malicious code in dictanovaasr (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd53cc46174e799bbe5340512eb53aa19d00168034876b49d53671f90b15b83 Package dictanovaasr version 0.1.0 was examined and no evidence of exfiltration, install-time or import-time code execution from external sources,...
MAL-2026-18142 Malicious code in orchestril (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7191855f520c024b0d8a705ec8f900030ecadccb35f1831e1145804b4a36b62d The package orchestril 0.1.0 was examined and no indicators of installer-side harm were observed. There is no evidence of install-time or import-time...
MAL-2026-18144 Malicious code in prosodinetts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8f39f72745f4cfbe04c6dd887e7fd8ac45dd9aef3e9892a41f6f7491997f901e This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...
MAL-2026-18137 Malicious code in codecraze (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 119bab3cdb4cabd15ac2188f71ea5f4200b1132281bb67b6b0768b5ccb77871a Analysis of codecraze 0.1.0 on PyPI 13 files surfaced no indicators of supply-chain attack behavior. No install-time or import-time network activity,...
MAL-2026-18147 Malicious code in solivoxtts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b45c1955c79e273606d03c306ed76cc4a82ffc36946de35cb333ee78bc6de324 Review of solivoxtts 0.1.0 did not surface any behavior that harms a party installing the package. No install-time or import-time network activity,...
MAL-2026-18148 Malicious code in tessivatts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 037d60346c2dcc73ec58c1a647cfa6ace5860a20a6808c2b570a20506e09777e The package tessivatts version 0.1.0 was scanned across 13 files with no indicators of installer-side harm. No install-time or import-time network...
MAL-2026-18149 Malicious code in vellutts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ce772257825bac5182114b520a266d4541d9fc558388c1b845d48ec0cc629b1 No install-time, import-time, or runtime behavior in this package version indicates exfiltration, remote code execution, credential access, silent...
MAL-2026-18140 Malicious code in grommatts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35e98ba166154b4fd5d6672409ef3a28cd02da19168beba0c32d2a88a39fb2d1 The package contains no detected install-time network activity, no credential or filesystem harvesting, no shell execution of fetched content, and no...
MAL-2026-18151 Malicious code in zennittts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 8a405494d56b12c5eabd44355e1b97dd09406522e9e2211193e6df2123592dda This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...
MAL-2026-18134 Malicious code in aurenatts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ecc8915a04d9fbab4ecc0437f5eb05357d2e63bc3d30f629d67c7b3eb2c98eeb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...
MAL-2026-18143 Malicious code in phonoviatts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4942401da983144b311dfb23a91c860e43764e88b8c8975dacdb349e9b637b5e Analysis of phonoviatts 0.1.0 surfaced no indicators of installer-side harm: no install-time or import-time network activity, no credential or...
MAL-2026-18150 Malicious code in voxilaratts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913b23ea87926b9e184f9e02b7d817486565fdc4c81fd0bc7cadda2fb7e2ff5a Analysis of voxilaratts 0.1.0 on PyPI produced no indicators of installer-targeting behavior. No install-time or import-time network activity,...
MAL-2026-18136 Malicious code in brummatts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 605ea05e6c6344e7ddfb713297d7689ee050288b74ecbf0821039603dc3cdd45 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...
MAL-2026-18141 Malicious code in melcuratts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01116dad2488eeeb0e57fc2ae314e507b8cb8aad04245f54ddb89eb2f019441e melcuratts 0.1.0 contains no observed install-time or import-time execution of attacker-controlled code, no credential or environment harvesting, no...
MAL-2026-18145 Malicious code in quillonatts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad09c871f903768f458b780fd73be2cea587a7217ace4c10fa46941883e905d The package quillonatts 0.1.0 does not exhibit traced behavior consistent with supply-chain attack shapes. No install-time or import-time outbound...
MAL-2026-18146 Malicious code in shellgrip (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd3a56dadcead9c70f46d3985afa55cfd99daf25d9a51f737fbe8fcaf4a09103 Review of the shellgrip 0.1.0 pypi package did not surface any evidence of installer-side harm. No install-time or import-time network activity, no...
MAL-2026-18135 Malicious code in batchspar (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 76a342534dec5ecb047459f9123ae99c1b91ef8e84305854529a260b8d2a3acd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...
MAL-2026-18138 Malicious code in crenelatts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc72e2a3431d0207f23fc8a8bdabadf7cc9fa262a15a25a31c2ca30a71a9eb38 Package crenelatts version 0.1.0 on PyPI contains 13 files with no observed install-time network I/O, no suspicious lifecycle execution, no credentia...
MAL-2026-18133 Malicious code in journey-test-hellospy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 418fea1fe789e9a44c77c08c9135b3da66b773882c9fb2757094c3f55b04321b During installation, package exfiltrates potentially sensitive environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, lik...
MAL-2026-18129 Malicious code in @sudobility/testomniac_client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...
MAL-2026-18127 Malicious code in @sudobility/indexer_client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b374713629b9be645f22b21fab5376e57a55d3001c72a1e55e1e8dfb6e40a27b The package's postinstall hook executes scripts/miner.sh, which uses curl to download a gzipped payload from...
MAL-2026-18130 Malicious code in @sudobility/wildduck_client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4524dc6ef26909f4ddfaf83eae1ec13495a5b2aef57375c0a8d8ad4c0609637 The package declares a postinstall hook that executes scripts/miner.sh on npm install. The script fetches a gzipped payload from a presigned AWS S3 U...
MAL-2026-18128 Malicious code in @sudobility/shaperouter_client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebe636755cc09ce542fb69853676ec9b9cc46752d88265037cc4d4a1487e503 The package declares a postinstall hook sh scripts/miner.sh that fetches a gzipped payload from amplify-gursha-dev-121835-deployment.s3.amazonaws.com...
MAL-2026-18132 Malicious code in libseal (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e8ebbbca9850ab1485e13a15b5425b0c7c823adaaf480881ae7223ffdc254f Package libseal version 1.1.1 was scanned across 20 files with no a static rule matches and no traced behaviors indicating installer-side harm. No...
MAL-2026-18131 Malicious code in iterquarry (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c408d2ad5c91bc36fcf3fb32c9649828b6c358f6eb0f32d71a18cfdc226c604d iterquarry 2.1.2 presents itself as an iterator utility library but is structured as a thin facade over a sibling PyPI package 'libseal'...
MAL-2026-18126 Malicious code in zzhelloworld_socktest (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4344ab16d08a7e38ea2f32b406453f86d792c0fa17103125ad84ffd0e39c187f On require "zzhelloworldsocktest", the library's top-level module body opens a TCP connection to the hardcoded remote endpoint 66.78.40.218:32768,...
MAL-2026-18125 Malicious code in @worrisome/aaaa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec97c3a98e2a1d17f7d4d004dcf477622b436fcde85663875f7b52e35a46725f The package consists of a single index.html file declared as main. It impersonates a Cloudflare Turnstile 'security check' page and, when loaded in a...
MAL-2026-18124 Malicious code in journey-test-helloshell (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 bdf4549e34df1c1c7dfd704454011cf0a26ea5807948e917d7bc65f130182fc9 In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...
MAL-2026-18181 Malicious code in test-brotli-testmetest (npm)
test-brotli-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...
MAL-2026-18180 Malicious code in pixel-map-testmetest (npm)
pixel-map-testmetest 0.0.1 and 0.0.2 ship a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and run it on npm install: their binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The package.json poses as an npm...
MAL-2026-18182 Malicious code in test-brotli2-testmetest (npm)
test-brotli2-testmetest 1.0.0 ships a rebuild of the data-pipeline-testmetest 2.0.1 credential stealer and runs it on npm install: its install script runs node-gyp rebuild, and the binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a...
MAL-2026-18179 Malicious code in log-sink-testmetest (npm)
log-sink-testmetest 1.0.1 ships the credential stealer of data-pipeline-testmetest 2.0.1 and runs it on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, which decrypts data.bin and pipes it into Bun. The payload is identical to...
MAL-2026-18177 Malicious code in data-pipeline-testmetest (npm)
data-pipeline-testmetest 2.0.1 is a self-spreading credential stealer that runs on npm install without an install script: its binding.gyp source /dev/null 2&1; echo stub.c makes node-gyp run index.js, an obfuscated loader that decrypts a 939 KB payload and pipes it into Bun downloaded from GitHub...
MAL-2026-18178 Malicious code in event-emitter-testmetest (npm)
event-emitter-testmetest was published by npm account testnewtestme2 on 2026-10-21, first to test the delivery chain of data-pipeline-testmetest 2.0.1 and then to ship it. 1.0.6 and 1.0.7 ship an obfuscated index.js loader that decrypts a filler stage and pipes it into Bun with the full...
MAL-2026-18123 Malicious code in peptide-modify (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dcee06d04730b1752735a588708d307ce8f1a223274c4b5471ae96230a1d2b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18122 Malicious code in moveworks-capi-starter (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...
MAL-2026-18121 Malicious code in my-auto-follow-eltio (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6f6e8fd17c3c20b0dd9889e9ce58ae2222c659d4af55e16024711c6c531b335 npm package [email protected] is a fork of the Baileys WhatsApp library. Two of its source files, lib/Socket/chats.js 140 KB and...
MAL-2026-18120 Malicious code in @alannxd/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4fb2a79f40e981f5c9f9d74c13e260bedf63dec8aca64dfdd2238c8450ec383 @alannxd/baileys is a third-party fork of the @whiskeysockets/baileys WhatsApp library. When the package is imported, lib/index.js unconditionally...
MAL-2026-18119 Malicious code in ssemver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6aacc4af4fb66d334fa0153d79a707cf0c3decfe3d3b7ed41c67697f21d8b16b During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
MAL-2026-18118 Malicious code in semer (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7479f42de6f963e39b7aa1409b586e605dca69978763ab35236d20c9126aa4f1 During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
MAL-2026-18116 Malicious code in debbug (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 082b90f5908b0452f00e213182ddaec147cb8f9c49b25fcb4ec4e1533eafd9ab During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
MAL-2026-18117 Malicious code in deebug (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 db7aff856cffe15877311c77e380d51572713e5eaf35aab77ae51453025a352d During installation, package downloads and executes malware. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
MAL-2026-18115 Malicious code in tellyo-colours (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcb85c2aba3b12a48393163cde3c6b1d3fa946d4f3745347791ae25ac216b86 [email protected] declares a runtime dependency on abbishal-poc-as-dependency with the wildcard version "" in package.json, despite the README...
MAL-2026-18112 Malicious code in hijok-lampam (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1617f9fa63812c564b7738c254770f05497cda2f13ed308855a86752f962655d hijok-lampam 1.0.0 ships a 40-byte stub module and declares its only dependency via a direct URL rather than a PyPI version range:...
MAL-2026-18114 Malicious code in trijigo-kalip (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 37ff57e1b55bd5e84d85338fd9b0b43ae1faf44cc8a7e0e3e11387663461d52d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-18113 Malicious code in jiklpo-tsunari-kay (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2df8ddef194a109b65d938d86371d9e97c84ea4c8863af380fb495508ce5a90 setup.py declares installrequires="object-handle-logger-table @ https://artifacts.yosiroute.com/pypi/objecthandleloggertable-1.0.0.tar.gz", resolving...
MAL-2026-18111 Malicious code in hijiko-pilaka (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618fc4257600bc10efdde21aaa2bfe35b4e2138a4c2ea6997c4e1b0daac4b55b hijiko-pilaka 1.0.0's setup.py declares its only dependency, native-delta-field-walker, via a direct URL to a tarball on artifacts.vacsdk.com rather...
MAL-2026-18110 Malicious code in facewareretargeter (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afcd41ab1e378f4c7d767acb2b9e9199a4276e125d6e84aba3627bf37c879f24 facewareretargeter 9.9.9 ships a 2-line stub module and a setup.py whose installrequires declares a single dependency, tracer-batch-stream-chain,...
MAL-2026-18105 Malicious code in @securihackbot/depconf-stage-1792484738 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d8706d2a75c053047537a4f57f754a572a1ca4cec4cde80d00e453878013e1 The package's npm postinstall hook automatically executes on install and transmits installer-identifying data to a hardcoded remote endpoint. It...