239861 matches found
MAL-2026-6937 Malicious code in nuxt-fonts-devtools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ede5024b6ee71356eedb3dfb3bb648682901bf6b966bbe353daff6082ecc85 Package ships only a package.json and a readme; there is no main entry, no bin, no scripts, no dependencies, and no executable code. The readme...
MAL-2026-6930 Malicious code in annotator-harvardx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e60352f3188693c150a75a0c785e9398fd12270a4cd481c3bcb411993beffbbd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-6941 Malicious code in shopify-internel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eb1d4e4e70cff6efbfec48cbf205e071c73a70003863e2293dbf7035547f560 Package name 'shopify-internel' is a one-character misspelling of 'shopify-internal' and appears to squat on the Shopify namespace. The tarball...
MAL-2026-6940 Malicious code in rnx-align-deps (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fd85779926afc494fd03f154fa151e30ee831b5aa8f260e01b29ee8f7a676d5 No a static rule matches and no behavioral findings were produced for this package version. There is no evidence of credential access, network...
MAL-2026-6936 Malicious code in nonexistent-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9393b3fc67ac5c169de7089d2f5100b5cb49af4e2b747b46726660bebc2bf66a No a static rule matches and no traced behavioral findings were produced for this package version. Nothing in the analyzed artifacts indicates...
MAL-2026-6933 Malicious code in hook-augmenting-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fbb17d535ecc8b30b2ab54a487691ec2e427f9dbc3c0e20acad414bb25f3203 Analysis of this package version produced no static or behavioral findings indicating installer-side harm. No exfiltration, install-time code fetch,...
MAL-2026-6942 Malicious code in some-theme (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97420170b95f54c404226b47901bbd45ec03ed0a427369b50add75297a2dcb80 Package [email protected] was scanned across 2 files with no a static rule matches and no behavioral findings. No install-time lifecycle execution, n...
MAL-2026-6943 Malicious code in tx-guard-snap (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fce7ebfc771355b732949df26e92e2ec8a80c0de7cda46bcb865687c33d572ff tx-guard-snap advertises itself as a real-time transaction security analysis MetaMask Snap but performs no analysis. Its onTransaction handler...
MAL-2026-6945 Malicious code in jsonschemavalidation (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eae82aa94c358f1f00f8a12e8b583cee82efdcf09d2f80263e6851ac0fec98f3 The PyPI project jsonschemavalidation builds a wheel whose installed top-level package is literally jsonschema tool.hatch.build.targets.wheel package...
MAL-2026-6929 Malicious code in paysafe-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ef2b75345902c9fe851d85e09c4b6680a3685669ab4dcd8b827ebaebb46626 Package metadata claims to be the 'Official Paysafe SDK for Python' by 'Paysafe Developer Team', but the shipped module is a stealer disguised as a...
MAL-2026-6928 Malicious code in paysafe-payments (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2b7f287703755dab866acf1047a148e321d06a84353238936eaba58b6e7fda Package impersonates the Paysafe payments SDK metadata claims 'Paysafe Developer Team', 'Paysafe Payments processing library' but its advertised...
MAL-2026-6927 Malicious code in paysafe-kyc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c619e500f8070a5525694f42547c0b73e8189965f8816f1a124190f50bed6f5 The paysafe-kyc package impersonates a legitimate Paysafe KYC/payments SDK author string 'Paysafe Developer Team', base URL https://api.paysafe.com,...
MAL-2026-6926 Malicious code in paysafe-api (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d9cc9039ffa3e8cadc8a24b0ccd83bcc8eca2fe88e25f35b2022cc1957220fb paysafe-api impersonates the Paysafe payments provider package name, description, author 'Paysafe Developer Team', and use of api.paysafe.com /...
MAL-2026-6931 Malicious code in chai-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9192d163b3814064c95a23cb11e218732346628f3109517aab7697c2dcb6d016 On require, index.js spawns a detached background node process that runs lib/initializeCaller.js. That module axios.gets a base64-obfuscated URL...
MAL-2026-6919 Malicious code in chai-chain-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1964693dd7c2bdd9ca7ae20eb441597571b1b78a689bd97648998c6442bda99 Package impersonates the pino logger exports module.exports.pino, README uses pino badge, keywords mimic pino but its actual behavior is a remote cod...
MAL-2026-6923 Malicious code in notifier-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a5846e3c26fdded8225d54ec017b01be255353470c39a780bbd9b556c059120 The package presents itself as a pino-compatible logger README, keywords, and a module.exports.pino alias mirror the pino identity, and lib/ replicat...
MAL-2026-6921 Malicious code in jsf-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a2a0bbd4939a789673bdca08866c9be58dd361df175695e7f8c1141bed4e47 On require'jsf-utils', lib/string/pathcase.js runs a top-level async IIFE that fetches a JavaScript payload from https://jsonkeeper.com/b/BPB86 and...
MAL-2026-6920 Malicious code in crypto-base58 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7da752b2532b67e824f8904ffce7618b074a6a58746099b36b4ee547d936c8d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-6925 Malicious code in typescript-base58 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b860a9c4960f55c236ca5e14781f5dcfb60752d4367cb9aeb30762d3b023004e [email protected] is a one-line re-export of the 'base58-core' package. The README advertises 'Zero dependencies' while package.json declares a...
MAL-2026-6918 Malicious code in base58-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a7d188e2cd79918987f2008e93bb80ea9979d791b357f8f7cfd892321ded6c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-6924 Malicious code in solana-address-codec (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1008cff7bb82464ce9ade3ae5c353e929b7367800b404a038baa8a026c69ae The package name resembles utilities in the Solana ecosystem e.g., @solana/addresses and address codec helpers, which is a common target for typosqua...
MAL-2026-6916 Malicious code in @sqlite-list/schema-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db66a72ece64d62fe02a712d609f136a1d5bae710c8a97b82dde8e7c39ad9bf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6917 Malicious code in @sqlite-list/sql-creator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df9b7b4865e558e78c513925af57c239035b06c15e4ba58f0daf96533d3a336d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6915 Malicious code in @sqlite-list/createsql (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 955f0446501d4d7834ea1d6f4daf244eed7c040462485ba6dc794488f455ea9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6914 Malicious code in @sqlite-access/nodesql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5454044dfacdd12da8025ba7a7c73260f16c64b29dbd25ebda52af4d03e8450c The package presents a three-way identity mismatch: the scoped name @sqlite-access/nodesql implies a SQL-access library, the README markets a...
MAL-2026-6922 Malicious code in mcp-server-pg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d68bdfced357622e33e4608bd35ded4d8988ea6dc7da073b3a83075978815d On npm install, scripts/postinstall.js unconditionally reads a range of installer-owned identity and configuration files and POSTs a JSON payload to ...
MAL-2026-6912 Malicious code in @engagehub/test-claim (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ab727c7412637f0d9a8b0eeb15d022a379de2eee3e10a30ad80b923b07ad553 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6913 Malicious code in brunomenozzi-test-pkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e06729f2b798e8015cdd50f9f6f1915a4d3ef45ebd8da4f67d9c8917fbf6188c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-7447 Malicious code in zreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7446 Malicious code in zircuit-vault (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7445 Malicious code in zircuit-reporter (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7444 Malicious code in zircuit-oracle (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7443 Malicious code in zircuit-keeper (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7442 Malicious code in yreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7441 Malicious code in wreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7440 Malicious code in winston-middleware (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7439 Malicious code in win-env-setup (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7438 Malicious code in whaleco-assets-json (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7437 Malicious code in web3-runtime-engine (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7436 Malicious code in wazirx-localtestnpm (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7435 Malicious code in wazir-xlocaletstnpm (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7434 Malicious code in wallarm-design-system (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7433 Malicious code in vubiquity-website (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7432 Malicious code in vscode-component-explorer (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7431 Malicious code in vreactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7430 Malicious code in ureactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7429 Malicious code in treactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7428 Malicious code in timelycare (npm)
--- -= Per source details. Do not edit below this line.=-...