MAL-2026-17388 Malicious code in baileys-xbats (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17818 Malicious code in @alipclutch/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a547c784c13d1a96d07b03039a8997721e06467bda6794a2a1cc14a2cb68ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17352 Malicious code in @fhkryxv/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17353 Malicious code in @fhkryxv/baileys-new (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17821 Malicious code in @fazzcodestudio/fbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02d04f078ee45b434a2f48ebecea2fc18811a6830ab2e24baccea6e577baa0e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17842 Malicious code in @we3js/framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b363085b57cf1cfd50b00e3845bdd50122e4e2f137a124def03f5cf59e7b23b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17441 Malicious code in @fazzcodestudio/wa-web (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17820 Malicious code in @fazzcodestudio/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d9a7ab4b8ee5eb018dda5e7d3b273e9bc690364e24d4ece93d1107cfa791d56 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17822 Malicious code in @fazzcodestudio/mediaformater (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2777e6e1aff40e693fdc759b07014c5ad7c6b24fbd40d3b3cdb8d2f32c6249ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17819 Malicious code in @badzz88/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0eafa4b306df1ba72117512af8f1b676cd101c93bac67d887418f318b39efcc6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17340 Malicious code in @astracode/byles-new (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17823 Malicious code in @modss/libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78daaf334cc6740c70b214309f4bf742a863b8c3c421076490cdb84790dd9550 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17368 Malicious code in @mivesensei/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17367 Malicious code in @mikudeveloper/grace (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17814 Malicious code in @mikudeveloper/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4749ec89d8c51729fbd97994a6a035ab229a56bb1094c4c47d9a3d68df050711 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17813 Malicious code in @lekzo_dev/amprem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec2a03e817ffe43fd777ac600302898da7b30ad7653e1c57bea618e9801dba3b Package presents itself as an 'Alight Motion Premium Activator' and exposes an API that POSTs caller-supplied email addresses and 'magic link'...

MAL-2026-17815 Malicious code in amprem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61910a4032ec54fa4fc9563754df94a67c45a324a3fb6210d51cb0f03d2b0a07 [email protected] is advertised as an 'API Scraper untuk Alight Motion Premium Activator' targeting the third-party service alight-motion-premium.site.je...

MAL-2026-17361 Malicious code in @kanaraa/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17360 Malicious code in @jojoxyz/condemnedforce-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17355 Malicious code in @ikanngeming/ikannbail (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17816 Malicious code in ikanngeming (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 966642a4fb31fee9c17517bf5b81d34a3d86345ee225b4dfc07f33bdd6636112 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17811 Malicious code in @ikanngeming/blubub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6701e3a14d508c7dfb1376d6becb7c1b53519b04c4b3bcdcd4c3706778150e61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17817 Malicious code in nakkinpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 331be4e62118311084ef5b928ef3bedc450c59ffb7433d02246886cf501727dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17812 Malicious code in @ikanngeming/npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50b6c41210ca33afed30bcb7c8f5b78df510ea3a5f10608d48c6c45d240cbabb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17810 Malicious code in @zaka13/zakasite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15276369023f332e049b1b25b23be8b056ce333649434f79d0f41f3bbb1930b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17809 Malicious code in minecraftaccfinder (PyPI)

minecraftaccfinder was published to PyPI on 2026-10-12 in six versions within 23 minutes 0.1.2 at 01:05 UTC, 2.0.0, 0.3.0, 0.3.1, 0.4.0, 3.0.0 at 01:28 UTC with no description, author, README or project page. The package consists of one module, minecraftaccfinder/init.py about 87 KB, 88 functions...

MAL-2026-17808 Malicious code in @s4yhiitestpoc/r2-https-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e89449bafb4f816bd8605f45cedf0fec8ec0cff9088007a7a38aaea0a9db91ec On npm install, postinstall.js automatically collects installer-side identifying data — hostname, username, home directory, non-internal network...

MAL-2026-17806 Malicious code in ap3-foundations-ui (npm)

ap3-foundations-ui describes itself as a security research PoC for dependency confusion and does not identify an upstream package it copies. Its preinstall hook runs node index.js during npm install; the script sends the package name and version, hostname, username, home directory, working...

MAL-2026-17446 Malicious code in luoxy-baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17803 Malicious code in hridoy-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 221c8e51e1341e954c4f2ea3ea4a139606138c8ecc1ab99e17f403e304f05157 hridoy-ultimate 8.0.0 is an unofficial Facebook chat client that contains two installer-harming behaviors. First, the password-based login path in...

MAL-2026-17763 Malicious code in @coopeuch/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a2aead44a4adb850635cf457613400d143b9e4f047767b111058b881cfbb3f On npm install, postinstall.js automatically executes and collects a detailed host and environment report — hostname, username, uid/gid, home...

MAL-2026-17761 Malicious code in @coopeuch/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 042f083be94ae23751c73b5a73c0f11e4e9ecafd9ee9f1caa8c05b367ac71de8 The package declares a postinstall script postinstall.js that runs automatically on npm install and collects a broad set of installer-side identifier...

MAL-2026-17766 Malicious code in @s4yhiitestpoc/scan-https-d (npm)

Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...

MAL-2026-17760 Malicious code in @coopeuch/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887c41c0805d7d223c499e702796cf46727b0be152b7c8a65607907afb3b5d59 @coopeuch/[email protected] publishes to the public npm registry under a scope the publisher does not own, using an inflated version 1.999.999...

MAL-2026-17764 Malicious code in @s4yhiitestpoc/r2-https (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6042f718b39be380eeda7c31dc46b056e753cb8a39e51897c8106e49b44f4d0 On npm install, the package's declared postinstall script postinstall.js collects installer host fingerprint data — hostname, username, home director...

MAL-2026-17765 Malicious code in @s4yhiitestpoc/r3-https (npm)

Dependency-confusion proof-of-concept package. A postinstall script runs automatically on installation and sends host and user identifiers hostname, username, home directory, network interface addresses, platform details and npm configuration to collector.oob.s4yhii.com, with a secondary DNS look...

MAL-2026-17777 Malicious code in react-paginate-v5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c0f91fe35323a6f47033b90ebaf88498a36fd7e8e933711b2cf301dba2e4759 [email protected] is a dependency-confusion probe published under a name resembling the popular react-paginate package and pinned to an...

MAL-2026-17772 Malicious code in liferay-workspace-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f package.json declares the sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz...

MAL-2026-17770 Malicious code in ksp-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b14a9fbd9fc1a48dc3ac0498f9606cecb1a56bad912c7f8a818fad332ef9ad15 [email protected] is a dependency-confusion-shaped npm package whose only payload is an opaque prebuilt Linux x64 native addon loaded at install...

MAL-2026-17771 Malicious code in ksp-client-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b11a639f5149e4b1c17e64eb78f226abece5ed03152b5933333a3cb56284018 The npm package [email protected] ships a prebuilt native addon at prebuilds/linux-x64/addon.node that is loaded by the package main...

MAL-2026-17767 Malicious code in another-very-long-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea9e3cf3d973c07d09048435d4ddc496574ce222d650c228b1400d866ea3ccf [email protected] ships a beacon.cjs that is invoked both from the declared postinstall lifecycle script and from the module's require-tim...

MAL-2026-17778 Malicious code in some-very-long-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c08ea2abb307f6ecb9a1896fcc3980e9a1eaf8b29044db67cd985654e1db16 The package is a stub whose main module exports a Proxy that returns a no-op for every property access, providing none of the functionality implied b...

MAL-2026-17773 Malicious code in nested-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a0b849de5330a4a4984a855f83ce1638b17e459d359312319ff35dc0e02f928 The package declares scripts.postinstall = "node beacon.cjs" and index.js also invokes require'./beacon.cjs'.fire at module load. beacon.cjs POSTs a...

MAL-2026-17776 Malicious code in pay-methods-kmf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07a616a1db0408a0570000c6514224d22e71c3ecee0f08268b5dd9bc96761fd2 [email protected] is a trivial stub empty index.js, manifest description 'Frontend utilities' that ships a prebuilt Linux x64 native addon ...

MAL-2026-17768 Malicious code in cloudflare_module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3a545e1e930894c3320e68c2aee17dd2cec7f20ed03b2e882905056d0eee242 Package [email protected] is a dependency-confusion lure targeting the cloudflare namespace. package.json declares scripts.postinstall: "node...

MAL-2026-17759 Malicious code in @coopeuch/button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee1a3bb0818d46a9c83659ed32f8ab209477970658d5f6f8241a12c96d137c98 The package's postinstall lifecycle script postinstall.js runs automatically on npm install and harvests installer host identifiers — hostname,...

MAL-2026-17769 Malicious code in deposit-limit-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89565d767d3541470834dc9764af6e4abbe4acb5ba4eb721f7e3008e3a80b1d2 [email protected] is published as a 'Deposit limit frontend utilities' library but its main entry index.js exports an empty object and shi...

MAL-2026-17775 Malicious code in nitro-cjs-requirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostnam...

MAL-2026-17762 Malicious code in @coopeuch/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c9b2c76aac3e901d6585717a7e1f9729699bf3a4e280eb20a68bcef4d507d0d The package publishes to the @coopeuch npm scope at version 1.999.999 with a stub index.js, a shape designed to win resolution over an internal scope...

MAL-2026-17774 Malicious code in nitro-bundled-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622 The npm package [email protected] presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname,...