240368 matches found
MAL-2026-17856 Malicious code in opencode2-linux-arm64-musl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29d77295b1fca10788c9203f4cddd81390c2257ed49c9f260838bf5c383bab8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17859 Malicious code in opencode2-windows-arm64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 263b5345eacdaa0cb508c1d73db3da28902fd6e018ce8c01dc99ebc6babb9f97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17854 Malicious code in opencode2-darwin-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5536c7ac30ec68d1e8ab9f64da77fa154f6d1806df263ad0abaf3af38ab0e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17855 Malicious code in opencode2-linux-arm64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4a8829a49ed8b89e9b5b2e55e453eb1cec86c288c766ed209e907ee331a76f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17858 Malicious code in opencode2-linux-x64-musl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5865a6de931f6eeceeaa7735203a1da71c5d55a10a580273fc8111210a14eaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17853 Malicious code in opencode2-darwin-arm64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c6a79212b7f12e5d4cae1e3d44b47da54ab2e77545f488b99f6f2dab8a5e638 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17857 Malicious code in opencode2-linux-x64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf9deaf78da8cb6d551cd438b47ce0b248159ff7ee5768fd54427262a271be93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17852 Malicious code in opencode2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1c255dbe0332f8e9a436b4e71e3a6079680d1b6c64da0537c8600754a9948ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17851 Malicious code in yoodan-github-single-ver-pkg (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5ec21b694320e65a8b1f38838f14f00ed00b3b1e4f6a5d6aeef960f900d1d55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17867 Malicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)
@accenturecodefoundry/mfe-pot-shared-ui-scds-core describes itself as “A simple placeholder for npm.” Its preinstall hook runs node index.js || true on npm install. Version 99.99.2 encodes the hostname and username as hexadecimal query parameters and sends them to...
MAL-2026-17850 Malicious code in @chatest/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c6f7960bb0d0edc97cac2310f15f01156a4dbc0b19e8ba8e4a42075882dc01 The package.json of @chatest/[email protected] declares the libsignal dependency as github:chatunitycenter/libsignal-node with no commit SHA, tag, or...
MAL-2026-17849 Malicious code in brass-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657abbbfdd17b21af7ad85e8634e0fb2ac36e35c6b95996322f10584ef4c1570 [email protected] declares its only dependency ltidisafe as a direct HTTPS tarball URL...
MAL-2026-17875 Malicious code in monkey-tags-ip (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 53.4.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'ip.js', which...
MAL-2026-17871 Malicious code in @mntv-analysis/workspaces-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 65.11.3 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', whic...
MAL-2026-17872 Malicious code in @newspage/lib-ng-async-routes-ui (npm)
npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In version 99.99.4, index.js sen...
MAL-2026-17869 Malicious code in @mntv-analysis/ui (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 99.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
MAL-2026-17873 Malicious code in @newspage/libx-amount (npm)
npm user 'priyashareek' published this package in a dependency confusion campaign against the internal scopes @accenturecodefoundry and @newspage. The publisher used 99.99.x versions to outrank the internal packages. 0.0.0-stage and 99.99.1 are empty placeholders. In versions 99.99.4 and 99.99.41...
MAL-2026-17874 Malicious code in @user-interface-common/common-styles (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 66.1.6 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
MAL-2026-17870 Malicious code in @mntv-analysis/ui-components (npm)
npm user 'conx3993' published this package in a dependency confusion campaign. It squats a name that looks like an internal package and uses version 50.1.1 so misconfigured resolvers pick it over the real one. Version 0.0.0-stage is an empty placeholder. A 'preinstall' hook runs 'index.js', which...
MAL-2026-17847 Malicious code in npp-ml (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac13184b04573151fc11ac8de28c384f016b49ed76d8689f46cf5c24909feca The package's setup.py declares scripts='bin/python', which causes pip to copy the file literally named python into the installer's script directory...
MAL-2026-17443 Malicious code in @zanta/baileys (npm)
This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...
MAL-2026-17846 Malicious code in @yudzxml/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629ff06ada2390b75e4ba41304b30289746455bba454c455d04d7743f6998974 This package is a fork of the Baileys WhatsApp Web library. a static rule matched on keyword co-occurrence in lib/Utils/messages-media.js:...
MAL-2026-17845 Malicious code in node-telegram-sockets (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222b22669330f75e779595b40bac9e2a842ef38fad691aaa46a0f4a615a55fc1 Package presents as a Telegram bot API client library node-telegram-bot-api family. a static rule fired on keyword co-occurrence in lib/telegram.js a...
MAL-2026-17843 Malicious code in @xrelly-stack/bails (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 195817f808f7604633cfab5e678aea8d4bb53f116c72605d9a2f0852834c5ae3 package.json declares whatsapp-rust-bridge-baron as git+https://github.com/7ucg/whatsapp-rust-bridge.git — an unpinned git URL with no commit SHA and...
MAL-2026-17841 Malicious code in @wanzxlonelyy/bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05fbc39cd82cca7d65bc1220f85315d4ad6584a5f28a9ddb0e38744dbbd9c644 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17840 Malicious code in @wanzlonelyy/bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b1103787a1c723a0e4102acd15834c5420336480aec1e6dc37ba741937f735a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17381 Malicious code in @wanzlonely/bails4u (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17838 Malicious code in @wanzlonely/bailsforme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1d20a942a9977d81d31c2c6e2107befe05ef40ea0f60363afb3132b03eb29d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17839 Malicious code in @wanzlonely/bailsme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f3eccacfdf2ece39dce55b7c1ba8330f39be88659053a43713fb16e39b6e2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17844 Malicious code in bailslonely (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a36c9cf3f28683672c6c3bc2ba38d881dec1c6bd97e72e2bf13e29ee76604389 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17382 Malicious code in @wenzyx1/bails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17837 Malicious code in @sanzoffc/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2838d53888242c50e19ce80fc949f25a34de59a1282fc3631abf64a671e7afe9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17379 Malicious code in @sakataoffc/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17378 Malicious code in @sairidev/baileys-new (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17835 Malicious code in @saazkira/eslint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 716e747d34d02e4d4b2d34558753e65ce26a72e086b5c2388427d22eb2b0e969 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17836 Malicious code in @saazkira/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c02ddff50116449dec10c106e58ae0c84f16919145b8e13ddea1a23b0f00e9c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17377 Malicious code in @saazkira/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17827 Malicious code in @revizahoshii/hoshino-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54e78d94690ef4e2d415c7754cf5e87fa9585670df0485bfd467a58e71a8afa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17825 Malicious code in @revizahoshii/hoshino-mcp-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9672a5dc6f8c45d8f76743e019edc248d1ba5523560bbe6e2a8185bac64b668c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17824 Malicious code in @revizahoshii/hoshino-fake-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bda9c3c386df18faa88110fc1cb8aa61654547c70ea0b3e970735dd69f247f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17834 Malicious code in @revizahoshii/hoshino-wam (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ae1d092716881cb0e1374342f7fe125511d3a712d0fb5a171ea4e859650dc90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17833 Malicious code in @revizahoshii/hoshino-voip (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 505d5a8535239db195966648019eb5584f9add49d96347a260c4d184c81e08ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17376 Malicious code in @revizahoshii/hoshino (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17830 Malicious code in @revizahoshii/hoshino-store-postgres (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 413598986f6891c8b092769e99f8995809b19b477eb3dff36899d857aec516ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17831 Malicious code in @revizahoshii/hoshino-store-redis (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 479c2ff94e78f7493a07e739eb36adc5eba6c31d7e2846a3ecea52d04dd3aa9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17826 Malicious code in @revizahoshii/hoshino-media-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65fe484d1302a25cb129e7fb56ebbf059f4c9469a85abc10ac695e605e34dcd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17832 Malicious code in @revizahoshii/hoshino-store-sqlite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5be1bfeb40b1b25c136a73036ef88cd35ed77e2662ca3e69235b4c3b081ff9cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17828 Malicious code in @revizahoshii/hoshino-store-mongo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbbe1a1b8523eee7d05bc6e5c5dfa9e65fd25e1c42b9fed34f645048dba47b6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17375 Malicious code in @revizahoshii/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17829 Malicious code in @revizahoshii/hoshino-store-mysql (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0b408e63765025424d6570c3bd05bd6e01534734e6613fabee59696d11d1f15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...