MAL-2026-17997 Malicious code in do-wnload-available-provincial-q7d0i-muzxoj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0018c31259848ed33b6990e6acff3ecf4ac7d644079c172f76f717b7d8a4c8cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18003 Malicious code in down-lo-ad-now-zip-mp3-duppy-writer-9bxwq-qpdzyd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 082189b6a0a6bb4bf5dd047752847d649a05cbcb3b2be4f37b4afc4fad9ff8ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17980 Malicious code in availab-le-alb-um-zip-101158-the-louder-i-call-the-faster-it-runs-64ggm-khmrzg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffe618d7973dbee320ebcd32d190c95411d70cc236b625a39948d8fe55d520fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17996 Malicious code in do-wnload-available-mulatu-steps-ahead-ag2jn-fzxotp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e31f44ca1e99435d949ced392e4cd3adbbe5c85754dfc91dd1b9634a2615510a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17972 Malicious code in ava-ilable-down-load-mp3-today-157397-polymer-0dwv9-btizmd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0de6f2e8761f78435572cd45fcf6c33ce59d7fa48330a3ed734f2e2760c391b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17984 Malicious code in availab-le-alb-um-zip-56502-interstellar-space-1qv3j-xsmien (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40c3cd94e0b897a5fc48ae36aea6d4099389fee64fadb3e3609a668885fe5932 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17985 Malicious code in availab-le-alb-um-zip-hope-for-men-wmh1o-fjstib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fadd8da74e4f46ecddf708eaa3719e2b0e41eab01e00362219103e3a2db26ad3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18006 Malicious code in down-load-available-zip-now-265533-the-safeway-elhem-xoyofv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ecaee3664d8ee566d98d8862f978d1d0f21b2cbd30a11e713f85d9c698aaacc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18025 Malicious code in mp3-file-zip-d-ownload-10759-grand-prix-ojzwj-auchhw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5beee8e9bda1a76ad80a7a3a5a97cd6828a7ff7d70a4dcb6165b849392e89215 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17981 Malicious code in availab-le-alb-um-zip-2022-482703-broken-hearts-club-bhvqx-hxwudi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5acb0effe20a5080a10bf052248557c8cda949e320736401373e2ef11926cab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17967 Malicious code in alb-um-availa-ble-zip-mp3-file-43857-green-light-mrpup-qmtshy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcc723342371a4e57d7b37779bcaa21f29d744537389b146a3e9ecb51849fff5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17995 Malicious code in do-wnload-available-f2oap-wvzhe9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f11ff9e5be5fb573f62f0c0f417b240714d84c49133dff475fb41b41213bf849 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18000 Malicious code in down-lo-ad-now-zip-mp3-12737-talking-book-grhl4-lwvpqw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a03934a286d0700768ce8aa67240943fe0772bf20322386f47d78c5eb0c1e79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17998 Malicious code in do-wnload-available-the-white-stripes-1-yywrn-pvfqxa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a5d812157727bd1a0218b766e1c6557f97493da83abaf8b746caad5285b13b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17977 Malicious code in avail-able-albu-m-down-load-6807-yo-bum-rush-the-show-tq11q-lqcaye (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d92654907f56ad794394682d8b26bb6fb8f26340bd5f090730593fd9fd326798 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17960 Malicious code in a-vailable-al-bum-file-19105-filles-de-kilimanjaro-4syt9-khnipp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8698298e3490944b1efb024b0c0565f3f177261b887395bd4469b0a3db772e3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17962 Malicious code in a-vailable-al-bum-file-30258-secrets-of-the-beehive-rk1pl-vebirt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 711a60021cd8fa5baa56abf71a1eb5e317d5fada82562f8bb1c413542b587ad5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17991 Malicious code in do-wnload-available-2013-5195-ripley-pine-zoryg-cyvlnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab47b050c80fae9e908b2ba52197ed2682d054410fe78dc51cecb93dff5b2d5a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18043 Malicious code in zip-mp3-a-lbum-do-wnload-new-67476-what-we-do-egj2h-bgfgzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a07066760715a68cc497490838eddc10c29b0c18af03a3df58114679dba0c0a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17982 Malicious code in availab-le-alb-um-zip-211740-city-burials-xwcy6-bhxnvc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0e280d968e65e1daace58bcd9a2d2a304bd745a398f8bc6195cc1108bad653d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17974 Malicious code in ava-ilable-down-load-mp3-today-35981-saints-and-sinners-mv3po-fqndxw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5217a1efc63f240765c4532704d6b6595a39e1bf476c8bcc789c2cfb39c6f841 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17961 Malicious code in a-vailable-al-bum-file-2015-39171-harmlessness-khwlm-ihtwah (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44e7ca3c4d507aa771d14fbc0799332e839a84404bd26ce164b5902c998fbee1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17964 Malicious code in a-vailable-al-bum-file-the-world-wont-end-7io2n-pbncia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8a3de985ebc9e2a00f5373d91fa6cb4289d523f15eedf107dbc88812770218f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17955 Malicious code in a-lbum-do-wnload-avai-lable-file-2019-138062-i-need-a-new-war-pp6yu-vclmgu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58cdac851d9895a1e03bc1606c6bc0edca565bf3eabb1166ab3495a948911b99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18042 Malicious code in zip-mp3-a-lbum-do-wnload-new-392999-fantasy-island-wlvf4-bxyvtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be713b34effa4525fe877715b47642a38f2c539a1ede69d96de63af66e942b7d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17999 Malicious code in down-lo-ad-now-zip-mp3-116827-chaos-is-me-rj9kf-abdorv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89171ca04fe46b4d4d48fcece86af44df40edecf22fa8f82ad244f737cd31243 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18002 Malicious code in down-lo-ad-now-zip-mp3-6140-the-ideal-crash-jysrl-jcdvdw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 413bb57ad4c5d6d8207af5cf729b511eebfeb944615465ba62be784ccee2a9ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18032 Malicious code in new-al-bum-av-ailable-girls-can-tell-ccfoc-vmqodd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c77833ab4e55ec9f565ed75b72ce20a80d8dc51fec19e2965609b881e48cf2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17958 Malicious code in a-vailable-al-bum-513977-rant-in-e-minor-lybr0-bdhlsb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eaf4a9b8797a44e404e0191319882ef754eb4881f5a1cc40868b811f37aae2c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17966 Malicious code in alb-um-availa-ble-zip-mp3-file-43838-stories-of-the-years-sslgg-bqfcko (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d116e3e21a54c953174cfea5d38e38c41e5681b3182c2bf04410029693a584c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17956 Malicious code in a-lbum-do-wnload-avai-lable-file-36733-tchamantche-9uiic-rfzaip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7da7a677624beee237b4a10d035455adc4b9475ce9ac87eb54ad9f9bf00b7f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17969 Malicious code in alb-um-availa-ble-zip-mp3-file-6053-the-specials-giqmz-flbewh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9eccc0208c328a4c0e6b718a982268822d174d7575713c3314230f6df93009fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17987 Malicious code in availab-le-alb-um-zip-the-visitor-l1n8t-frzacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efe181fe88827b53b10050931ce484b5a37d471ba7eaf171c7c60eeb2c69de3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18028 Malicious code in mp3-file-zip-d-ownload-hearts-of-oak-7cyqu-oiygcz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74975ac076a1d390227e09308021132195615ea9e569d6320a2d04d6ef51ffdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18030 Malicious code in new-al-bum-av-ailable-131000-eton-alive-qzngy-cjxczf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 951f0ebf686b9d2ba81a5056209d4d78a0348ae09d22401b544c5054606c436c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18026 Malicious code in mp3-file-zip-d-ownload-48120-lost-nation-road-0cibe-ynawhz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b46450dbe9541d268f8ff08a5d94671796222a3cda2686dbd030ffbb6ead4ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17990 Malicious code in bs58x64.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c6696aeb224149fed15d3bd864172571b55424f98466f6876dc51ca75063d6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17989 Malicious code in bs58x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a128d8d165acbbd45f7a6df88af9891256acebbc0880057acb0f94d5e660ffa3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17988 Malicious code in base58x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f37e6f705f32055653dd567f05118434eec1390d9961673981bb89bae11eaeb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17942 Malicious code in array-inline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8909a6ff094fd04116daf7c014101e9b002e9ea6e6456ff7ab5faecdf1422e1 Package [email protected] was scanned across 5 files with no a static rule matches and no traced behaviors indicating credential access, network...

MAL-2026-17934 Malicious code in array-inline-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56155285d4d49f75322eac616667d54fabe1c19efbf500a0cd631c479380d5bb The package contains a small number of files and no static or traced findings indicate credential access, install-time code fetch/execute, silent rel...

MAL-2026-17935 Malicious code in dsjklweuvhgsdcq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a374493c76cce0d4d3b1358003a3fbbb6ad103113a386966045d5bae0892a82c The package contains no JavaScript entry point, no lifecycle scripts, and no dependencies. Its only shipped file is an HTML page titled 'Just a...

MAL-2026-17936 Malicious code in mx3dxhgic8xhd6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4fbf379ad5f6f1c43cb74ef7fbc66e56fe9b0c0edeaffd1f51bb9e5558c2bb Package [email protected] is published under a random-looking short name with only two files, one of which is an index.html containing a large...

MAL-2026-17937 Malicious code in mxckjdgweuxpsiohd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5aef67c54559d47c77f1f78743ae13456271bd6343674a14976ca7dc3132693b The tarball contains a single file, index.html, declared as the package's main entry in package.json. The HTML impersonates a Cloudflare Turnstile...

MAL-2026-17938 Malicious code in nsdhjuiwqxmhsf1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9259b9f77730ae281a5467d21626b8ef91c6c41200acf321b28968b3d36c241 The package contains no JavaScript source, no TypeScript source, and no install/require lifecycle hooks. The sole shipped file is index.html, declare...

MAL-2026-17941 Malicious code in zxhgssiyluwxchn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4ec9075865f87bed709b7be203b621244e13b28d84e8bd47586d2df02e30a24 The package consists of a single index.html file set as main. The HTML renders a Cloudflare 'Just a moment...' Turnstile challenge page and contains...

MAL-2026-17939 Malicious code in ticketcathayoct12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6b742bdf2b31258a3708b4ec5c395708e8112d9b8616d7d97d21de8b73c9ee3 The package ships a single file, index.html, which impersonates a Cloudflare 'Just a moment...' interstitial and embeds a Turnstile widget plus an...

MAL-2026-17940 Malicious code in vjkpwjxbvndelta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b99400fad276cbcc12a4378e213d162e7992291ca714f3b410144f10d0c0ccaa Package contains only index.html and a package.json declaring main: index.html. The HTML is a Cloudflare Turnstile 'Just a moment...' lookalike page...

MAL-2026-17445 Malicious code in ichigo-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17931 Malicious code in aldi02-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52aad2c9e9c773ff8cc1529316069d58541e3fa677cda7ff75364c644154eb59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...