MAL-2026-11368 Malicious code in react.ja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 930eacb3381ac6e0b0ef948a53188dfb1c7822c18dde0235ed54b541d995e49d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11322 Malicious code in installreact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3762f9636d7f389b56f82d58118b7f760e04cc418fb0c008ee30054c5413a6e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11369 Malicious code in react.jd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 008700843ed05097ee21f8b83d03189f537561d672728b91715ce9ced41f5ecb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11364 Malicious code in reac.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a475a8f4fcdabfeeaab666f2e7ab900248f71d15004601f7d0e5fb2e02ecc1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11307 Malicious code in express.ja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b5e2c0bdef4cdd2a1717631e7cec1d0c7d7d945aa9e18ee73a53ff00debd0ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11308 Malicious code in express.jd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e19d28887abf013d2b9c10ea85d7ca19baeb30f52bd9de4589cd66e687975adc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11302 Malicious code in expres.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e2eb125cd826b1578646fdd06af4c5649ab6b31c1a39afc768bbc62bfdae0d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11288 Malicious code in ekspress (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware baaf72c7a3dade7b78af529b3c79190314cbae671ac77f925a18c46284c47564 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11367 Malicious code in react.j (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3edc074627d72dec2d6a9dd62c09d1d791bcab0a7a5817e8fbd9cf2152482cb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11370 Malicious code in reakt.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ff2841f53f4e574cacaa4dc1c13955afd830ecc4e34c57ef2e773477efa19a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11256 Malicious code in chalk-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 481067cbb929fab749f6e643d96126d0c74251e48609cce55eebf477cfd9ad99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11258 Malicious code in chalk-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ece655dd7e91fffbda3bf623e600cd48eab1155796c4752237a2911887d1d456 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11255 Malicious code in chalk-butons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0dc8638246791bb1c397834fde03907cdea6430e7da22bd9cd581964426d52d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11257 Malicious code in chalk-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec33c573b26dcd167feb75548bd7774af7a912c448fd08f624bead6e22deff13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11206 Malicious code in 1apijs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2700f92a449d39fb0881259de81734a6c2f7933dad7e567fd4284e58b6fe062 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11363 Malicious code in raydiums (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3fbaa5dc6f9b4df46fcb491e1a31924b028376844d5678688289fbae08b7099 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11405 Malicious code in ttest3333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 038978444c8a53a83f087f204dadb716b4b371c0064477688cdbb31ebe89a6a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11261 Malicious code in clo321 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8f8fdfecbace0a3b861bac6a6ddbed0f00e2a235328f12edabb853cd6bd5e20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11404 Malicious code in ttest333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b74ff57fa83801c9d727f00ead8619c39184c324bf8c82a1f34c7871154afe76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11262 Malicious code in clo321-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0c9047321cb681b8b97850ee266a48bd5d192eab6133c686b9f7dc0aa5f68d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11239 Malicious code in apijsclo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da32970b216a1f6c8a76d725bf614f8b6142ad2c3806578c2ce2feae22640a76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11407 Malicious code in uniswapintefrace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cd5488070442a7d4759895cd6b5243add2626b095f5da7cb1c08611c396e605 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11260 Malicious code in clo2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b6105a72b9d9a044230d0d4e787fe819d9f2195a5ec8f652797c02c514c9d40b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11259 Malicious code in clo-adspect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16d5f60729e87d5dd7493e2ac1a02be015c8965d03345be014ed5661c7f35c0a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11398 Malicious code in testtwix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 156314ac4405e3a399f43088b706e128ab5aad61f32cd5ec0e415af37feda23b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11263 Malicious code in clotest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26eeebdadc62206cf23d190ed10b2f46de8d8af2ac45d9e94aecca3b2c32b048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11199 Malicious code in ml-data-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff7fbcc539a2758c962aa64220b3ec62668dbd4a248fb8910956eb64ab7bd3ba During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11247 Malicious code in base58-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e95c5d853c8abc6b99f2a1cc48dda77eb93a732e34c6f253f9451b1a9e7b4d1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11246 Malicious code in base-x-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02b128e2527188695a34b319908cae8e30d328c4ac38be36cdbb0957af15e443 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11399 Malicious code in tgnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94acf1d28e1b8f8aa5afe5698d86dfc51989a56d5ccb99d848d2286b61dc21b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11341 Malicious code in node-logger-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34c9326339f3b11409e2afdb6f4ef3a338ce1fc23a1b8ea0511236e847118b5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11274 Malicious code in dash-merge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 533b218de7d9e1e925383f5f75cd29a4a2b6869e3d9a104907d4b0d133875a37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11201 Malicious code in ml-nps-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fed6e01148ede73fae9d01667807eb310434a9c801b9eb60f08141e34921fc85 During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11200 Malicious code in ml-fdbk-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f2313f59d10884a764cb2e2dbfe3aa8ae97545c995785f65ca1e856b4a29b8c During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11214 Malicious code in @grua/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1eabb3f38128e34522c4bca5893ed0e64bcbc213ef2f617cce26e584c220c037 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11213 Malicious code in @grua/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b0588f2a4e3843bee403528cb8502b7c4207d2ce3179e51649b3951f8a8d2b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11323 Malicious code in isix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15a2f3573252bd11418bee1071c2c055972d968f1401261f8c227afc249c90c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11227 Malicious code in @solana-sdk/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54e9ab1fe2590a2edf0b546231e23d61330ae2f1ee76f31b4df9afc8e4087d22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11210 Malicious code in @ethers-sdk/ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e6d5bcfe574a6eecbff6a32c084a7abd43660939adafa83c7097a96d1ca791f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11211 Malicious code in @ethers-sdk/wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38a8c103dc06261576987809af8a1deb696dfdabd93bf4116f42ee199ee77cc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11202 Malicious code in ml-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89a726ddb6cfd4ce7da05b1b8c75e896e38789aa418c71d4db76f499b5727cb3 setup.py defines a function named analytics that collects the installer's hostname, username, current working directory, and the entire process...

MAL-2026-11282 Malicious code in dotex-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a24f0c08a385f2366e23764f896e95c701acd9d746152a5409b1b6a1ca4c766b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11281 Malicious code in dotenv-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7926abbca35dd3e5fa6c841ddff70fda3bc8330d2e427fe5747a23c264a4f45e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11267 Malicious code in compose-logger-stand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34de797bc2020fd52b9b36fda8513a111610612c3a50e75d8ea8a79440be4f0 [email protected] presents itself as a logger but its shipped code implements a credential-harvest and exfiltration pipeline...

MAL-2026-11411 Malicious code in xp-node-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dacb3f21efc94ccf0bbcabc232b84f156d79b073feaf3e5bbfa40bbf998ba1d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11244 Malicious code in bajkvahzv8allnltvr7x4s5hdxkjvyji (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 33a3ac75333df2fe3d27eac3d771269f45d3567ec6203fc00b8e9b9234897744 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11326 Malicious code in live-reload-on-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7d87f94e77b603423e5ebb9e62f37541ad355708d900e33e0442210ce70957 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11271 Malicious code in cross-sell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69ca6d2d5b0f8c68cc8dd2f9799b681cd4fe6a1a5259d8b8a58653f528dccbfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11276 Malicious code in decline (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac37f89d973f66d0ea1d5bda82291d0a59d9c2e008775135c2dcecc422d92ca1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11350 Malicious code in pulleeelll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6b3173a308b5738e4e3047a8125b432486042563101678e0182e95962b37f20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...