MAL-2026-18649 Malicious code in @saidddddddddd/ggsgg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a1268262a3d83338b1943ef3df173acf8c772c4491952f40de77e34aa54c341 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18654 Malicious code in heheheshsds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a1d1c16da2b41ce6608187b251365bb923672ed0412858480e99ae43f94d8ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18655 Malicious code in nannnnnnnnn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae8dcee071dacb90e806d5a7864adf0ce140713e4f83f2e6a5804b1afb1bcce3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18653 Malicious code in dogmans-afterglow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1622f86127a25f1b5ebeee0530d41334242f185d382409e441058956299e3c48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18652 Malicious code in doghack-afterglow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f23b7276730ee41471843bc482c4ee3a68f288f8e625591d38b7cc478ab68b80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18656 Malicious code in thththtbhthhth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 592383fdf95ac0e0957f7c750b7063dda5d2428a36d783277918aa7501ed63c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18648 Malicious code in nminer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c898b43dd1ee0f1e9f5583261609fccdada1f1612e591381e05c64e032627e04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18646 Malicious code in @pubngo-stack/help-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92a89da483ef76193feafa163b5348fafe010999ac2e73154f9c9b3f33d07783 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18645 Malicious code in @cdmbase/wiki-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1abcd7d676a10de9db64d9be6dd532ceee0558062f45ddfb5f6137cb8ba8467b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18644 Malicious code in @adminide-stack/yantra-help-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a0da0aa5320d070b240dec07b393270995c492fb5ed23c7dcf8ae077583a409 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18640 Malicious code in @adminide-stack/forms-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b9e3f519363694211241ddf83d95c5f75a4f22ef9b5f60e2e962c01f97ddd25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18647 Malicious code in cdeops (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 380de9c4bebb6dbe605106630c161af02376f67c9810af146258afeabbafb901 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18642 Malicious code in @adminide-stack/user-activity-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb9b2ba8ffb0896aa285d4529591fddeb3c430a82f7dd72f0bd95764dcea64a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18641 Malicious code in @adminide-stack/health-api-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42e388478673b3533017aa796ce12bc8ad4dd61aa34ca7d0ad82417066573900 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18639 Malicious code in @adminide-stack/client-redux (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8da55a3bfba13507a552e0ed24d0aa8ac426e9b50055661ee71ea6c951830b30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18643 Malicious code in @adminide-stack/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab42798fc40b5b8c35b36e9aab872128a0a06d4f385d2aa56e59bfbf843482f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18637 Malicious code in mock-datas-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7795c5ecb71c77fcb6d7630bfb136c7edef41a13036dd6ae6ebb02dfe4b60618 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18634 Malicious code in data-sync-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49fd943e46e5ed64d42a0d3ea9dda036ad44eeeccf2e4b9b4c90ac243ba5bb78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18636 Malicious code in kvarzo-8f3a2-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 585289d80a705650a586dbdc453c0d5a6ed2399a338bf1309dfff7e41a804472 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18638 Malicious code in that-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28d56828b44836f8b55e591ad433f8b082433589f3275c892174bac0ac562ac6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18635 Malicious code in filipt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53f6b94af70b225ed3a3ee0edfa4db2469ca84bf27e23e46b61addcdabac9349 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18633 Malicious code in extera-runtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 400bf2ff64fec2a3d26fa477d19f25b0d2abfdc40ae5247531a128cfdc41aa19 The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically. --- Category: MALICIOUS - The...

MAL-2026-18629 Malicious code in @pasqua-baileys/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ac7d9dd9bdb2386edeecfaeb164fdec6a1ed775b3ca10152bd3f5cacd7b8802 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18630 Malicious code in @realvare/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeedb2f87aa3e579b9d8dd2d4f011e9c9a83d4383a7fbe1baa2dcbd0ca1660b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18631 Malicious code in @realvare/based (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 502a54ce6b029f4fbc2fa6ff211d917c97dd1379265ef0d2af3ea396d355e892 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18628 Malicious code in @fyxzpediaa/libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3808ed94ac5c3235bf07f26f1159927b61f4ce208749cee231682be3c30130e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18627 Malicious code in msgpackrpc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9747a902bd61a745ec9c8f569f57417303f828b441c3e4e8c95101adf1498d13 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18626 Malicious code in @ai-ecoverse/slicc-windows-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff47f1460fce06cddef5a6a77557395053917a94e987ddbc0f8d5348dc2034cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18625 Malicious code in extera-plugin-runtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b13320bcb71932e051e8e2a8fbd98f3e8faadae85f0ae60ca2f1c2cf8d827829 The package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically. --- Category: MALICIOUS - The...

MAL-2026-18624 Malicious code in screenshot-desktop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64a8bf18bfc6aa72293012942c4716b0fa4bdd134f4edd49d0b1c78cc966a5a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18603 Malicious code in @ifasn/ms-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d Package advertises itself as a Markdown toolkit MCP server TOC generation, word count, table formatting but its main/bin entry unconditionally invoke...

MAL-2026-18599 Malicious code in w002yardprobe (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 721580f8eda44ad5ee7604f5ba0648e8830302f784e3e4a995e02ca7359c909e The gem ships a .yardopts file containing --load./script.rb, which causes YARD to execute script.rb whenever documentation is generated for the gem...

MAL-2026-18598 Malicious code in brida-frida-hooks (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc383ba7728e9aec64324ce8b1c9b354b0331d7c404888e39d1d127885381e1d The gem declares an extension script in its gemspec that executes during gem install. On install, the script collects installer identity and local...

MAL-2026-18597 Malicious code in yzx-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b51b209fe5d701ec9bab4cc9544162b4232acfc18c867f4a1cd09ce816b1d788 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18596 Malicious code in mocha-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc4da3bdc21069601a8f0c9b06ab4b4f90930f54c1ed05c3162a2c52d27f543d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18594 Malicious code in tailwind-form-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 982a885e35238eeb63f37a2d7e87eac99ff0eaad0514cd7f61778e5511694d01 The package's declared main entry src/index.js begins with evalatob'' that runs on every require/import. Decoding the string-array reveals...

MAL-2026-18593 Malicious code in react-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d186bd6a8ec4a6482a8e951bac94904fef98f09e8a8fff714dd4526ba93557 The package publishes as 'react-contact-forms' but its package.json author is '@tailwindcss' and its repository points at...

MAL-2026-18595 Malicious code in tailwind-input-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 630101a331666e0b23f3bf13fc5b6390d361ccc4be631c55f6ea29d10f3f7711 The package impersonates @tailwindcss/forms name 'tailwind-input-kit', author.name '@tailwindcss', repository pointing to...

MAL-2026-18588 Malicious code in @touchkey0111/jito-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8783a215d13546b62ab39b9230f346367c912cf76218080d3d96c4d8b5db894 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18592 Malicious code in jito-bundle-tip-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 565f7de269854ec0dd2c7e78b81e3dfb04a318dd760ecf4897b97731ee6c7822 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18591 Malicious code in jito-bundle-solana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92a82743c84b99beaf31ce188b36df4abb4b8045524655e9310152d9ba998821 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18590 Malicious code in jito-bundle-jitotip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65f901538cb8c1e3c2bb9f8bb0fbcfda58c631a136a1419ea048c9cf9b3aa033 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18589 Malicious code in jito-bundle-jito-tip7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbd7164079f3dedd0a6b686c00d7c6c5284307a75ed8183fca263a4e43b1cbb0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18585 Malicious code in arbkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae8f9dd5f329cccd4daa03d6fdc316b116291ae853ab3119cc3fa3f34f6b62b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18583 Malicious code in ln9qw38745g (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e0a9c91e26a02abe14a9881a1c539a2f48d71aff120be6a4c286f36ee4cdd603 Package ships an embedded executable identified as malware by AV vendors, and is related to a previously discovered package that after a few releases swapt...

MAL-2026-18584 Malicious code in protecteda (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8fb01cc262b8645b045f6d9b6e0454ef525c928a48f8c0904cb63301f1be9e0f When started as a module, package runs an embedded executable identified as an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent...

MAL-2026-18587 Malicious code in txnforge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45b831fcc35bdfb28fa17be14f502a494fab42eb58556e61fdcffba0cb3926e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18586 Malicious code in print-hello-world-test-temp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b4c55a93972ce0e01df9479a68e4387ec3d069b461e7da17d134f9466054859 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18582 Malicious code in zyto (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 817f92245d406e764c42e8038b2ea559a6bd6deb1706b80e2699e0ab724111a2 The package ships an executable started during the building of a wheel/installation. It has been identified as malicious by some AV vendors, but primarily it i...

MAL-2026-18581 Malicious code in hijuko-pilara (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3e03de70d14b6b6e3965178f06a73eecdd7197978d8363aaa7c83cf8f3d32696 The package uses fake http-downloaded dependencies to track downloads, and has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical...