239960 matches found
MAL-2026-18345 Malicious code in dsh-vm-tester (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1be284bac4bce2eef52ff3aae58fdff4888a168d23057edf1f4c161ddb2a47c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18343 Malicious code in numprint (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243 During installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist. --...
MAL-2026-18344 Malicious code in adyen-web-v6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 201cc55005330d435dca4dce3bb894b3b2532ee387cb566e45c4ad223b1b8aa0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18339 Malicious code in buttoncontent (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18ee43e64a2d1a1e6de6c6dce2b7be4032731042b6ab27f86bdde5ffee1c9689 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18342 Malicious code in string-target-mapper-hash (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa1723c1a5589a8e05f050b8315839ef0733a2429c6da7993fba409cd36188de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18341 Malicious code in macro-kernel-record-reader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a821a18c84775371c80e1780152b05963b6223cc9e8f2e2e48ccf8ad7803c52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18340 Malicious code in fetch-hash-cache-atomic (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fe31e64c3fbc62b9e89b7b27b225663277114a17af5c84b4ea75ec3de4ccc8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18338 Malicious code in @azure-growth/signup-ux-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d6aa62a9421f736418e09f0b247beb52637c7cb21f03cfba35656222e48215fc The OpenSSF Package Analysis project identified '@azure-growth/signup-ux-components' @ 1.2.2 npm as malicious. It is considered malicious becaus...
MAL-2026-18337 Malicious code in @camera.ui/camera-ui-nvr-windows-amd64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c30bc8aad66d6b6a1c119c33762a0c8819a4169a9f5145f2b6999b65932a532d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18336 Malicious code in h13t0ry-hello-demo (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e27409f6c0ba5c7e7ba22f21c8b4806686ae8b64f4d7daf2dd9a7e6182bef5ab During import package starts a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
MAL-2026-18335 Malicious code in ctf-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bbe1eb2e2e46c8aa452e19060d6f37d8e744e62e5c58be091c4e1f263a09d1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18330 Malicious code in @iobandamwer/native-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cce0282c2e8975376db9fdb7a69afc7ed77c0e7649178967496467e09d7ba328 The package self-labels as a 'temporary placeholder stub' in package.json and README but ships active install-time dropper artifacts: a 93-byte...
MAL-2026-18333 Malicious code in path-stream-utils-testmetest (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 910dd2c3846dd989ee98147187c379760a3d055ffe413f85d36def235d6a7cf7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18329 Malicious code in @iobandamwer/cache-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 529f7b16fb0c62ee71033377d3aebf3048f045e18f982b99224a584be9c264f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18331 Malicious code in birch-css-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55ac470ab3260611fd8b69f59b1d1faae26e80e1c7e9c243cb0b65db56d5c231 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18334 Malicious code in postcss-semantic-themes (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d188bb5d3c330ed5c438865b3787cca124861eefe2c8e094e58511bbca437e09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18332 Malicious code in harlow-css-mixer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b980eedd59eb558f39a2675ea8570fe97d02c7b586e2a5c7f980e058d313601 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18328 Malicious code in netweavex (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3818fe7f3387637c23d6bc51d62f8fd64dc981c82167750cd3059eec73d2849c netweavex is a typosquat of the popular NetworkX library, reusing its public API, module layout, and README examples including the import netweavex a...
MAL-2026-18327 Malicious code in zagents-framework (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d16d137f59725b57a8d4dfbb6c9e5b88a07e1bf4fac71faf28e044208a21bccd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-18326 Malicious code in changes-lxc-wrapper (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 6db4cc796d2ddd54fcbb0a46270cff980f711a93a5fff30675499291d9bc41f8 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-18325 Malicious code in @worca/app (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81bf3d58c914a5ac183d3d53d0dbd113eff4fd5cbc5a4dc3ffb53f233550ad2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18323 Malicious code in publish-poc-base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bf2f71038e46898cc03f9bf5081547bb6d725e6a480ef22b80f4dc259c721d9 On install, the postinstall script in package.json reads the first line of../../README.md from the installer's parent workspace, creates a mktemp...
MAL-2026-18324 Malicious code in publish-poc-test3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4001a75b24abfa181a10e5d40931194f254304fcf5fda554488d3c242cc5db85 The package's postinstall lifecycle script creates a temporary directory, writes a fabricated package.json whose name is 'publish-poc-found-' random...
MAL-2026-17924 Malicious code in @apexacc/cli (npm)
@apexacc/cli is distributed by "Apex Accelerator" Apex Arena, a fake Web3 accelerator that lures crypto founders with free AI credits and audits. Elastic Security Labs REF8801, published 2026-10-12 found it is a repackaged Oh My Pi coding agent 1,351 of 1,363 files identical with malicious...
MAL-2026-18322 Malicious code in numbors (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 287297439c9bdf199a88d43f3722ab361fde262c2ff3ee0f813fff21275211db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18315 Malicious code in dsh-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6071592c29a573472ed3b8b3be61cb6f0a4c1801ff1ffd3f730f6e14d9e9000b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18311 Malicious code in bow-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f616a5be7835fbfd40088761cce2863d5ab04d1230e6b22a3e6dcd3fe2fc49b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17878 Malicious code in util-foriepft (npm)
[email protected] was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through childprocess and sends thei...
MAL-2026-18312 Malicious code in css-flexgap-shim (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f54735b551cfa311e09f18668c3b10360105519f2277b27d782036d3224c5b19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18314 Malicious code in css-hnhxwd-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fd2df1dd4f68e1495d31e75e18917e99ee002c60d5e0327d5d84f9e01d52e8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18313 Malicious code in css-grid-snap-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57386477a0e68347ddb17000b25af0a3ac77250d09dd32e453323a8d22ced32f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18310 Malicious code in @regex33-hackerone/tb-compat (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eee6c549826f67ecb00f8afe75a1524516d09e0e068bb23432239d270db467df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18320 Malicious code in @walknpm/todo-cli (npm)
@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with...
MAL-2026-18321 Malicious code in dsh-plugin-blender-3d (npm)
[email protected] is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to...
MAL-2026-18308 Malicious code in @s4yhiitestpoc/scan-echo-b (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56326de32baad0d0d893359e14cf73b56e8139d714f3106fde0c24fdb4004091 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18307 Malicious code in @s4yhiitestpoc/scan-dns-c (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb3c4b0863ee69937b926b58ee5255e26d0ab3737abd640b92956aef1ca03fb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18302 Malicious code in @s4yhiitestpoc/r2-control (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2818910f030224e598ac988354614e0febeaed195238b06fcefb80d1932dc965 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18306 Malicious code in @s4yhiitestpoc/scan-control-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d0a8c4d5ab871942d5301ffe7797ba35882108ed4f9195f5000f7e274455827 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18303 Malicious code in @s4yhiitestpoc/r2-dns (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0c56aeb91a20a757ea94500434819d64c0ab2a067c00ccf7dc325e23abdb46a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18304 Malicious code in @s4yhiitestpoc/r2-echo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95d0e909637faadf9360929eb9b01bfac02f0a4bdf7bff852267657d09c5b459 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18309 Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc69b9998deea152d8088db89469ab4f8fa468d68e8cb923b25c7e91f8facf04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18305 Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06d8987a5408de1fd879005877185e31a5a0931162318ade2fc1a4e6ce6592c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18301 Malicious code in dictmerge-lite (PyPI)
dictmerge-lite 1.0.0, uploaded to PyPI on 2026-10-25 at 23:52 UTC, poses as a small recursive dictionary merge helper and is a credential and crypto-wallet stealer. Importing the package runs the payload: dictmergelite/init.py imports telemetry and starts telemetry.runasync, a non-daemon thread s...
MAL-2026-18299 Malicious code in claudeopuseni (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715421a3b919f086db6ad4a57d6c8d6d333b019e3a63e607be95cf3fcb7aef5d On import, claudeopuseni/init.py invokes boot.check, which issues an HTTPS GET to https://thisisafalsepositive.st/cdn/v2/claudeopuseni/manifest.json,...
MAL-2026-18300 Malicious code in claudeopusenifile (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 051daf7dfb8c28210996afbf561646b38781f563483e6c2e7471add0a6021885 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds...
MAL-2026-18298 Malicious code in claudeopusfile (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de2f0d45d8a2c0489d082d86a91c63fc5cad53f891b3dd1e976cd7479344c65f setup.py imports claudeopusfile.compat.ensurecompat during pip install. compat.py constructs the string 'exec' from a chr-code tuple...
MAL-2026-18297 Malicious code in nebulallm (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 50e0ed125f08fd7743ccfb40590c24304b4731f6a99b69bc553b5bb8b7e57fc6 During installation package first downloads a JScript script, which then downloads the next malicious DLL. --- Category: MALICIOUS - The campaign has clearly...
MAL-2026-18296 Malicious code in zagents-message-bus (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0d1891d5d76adad51e120baa41752f0cc878b243eb400e7a12aba1616d31d1f7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-18295 Malicious code in @capsense/core-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd830a923fd6fbe61525c9d152a75384cbd42624a45edc957c2f055ff8fa61a8 @capsense/[email protected] is published to the public npm registry under a scoped name at an implausibly high version, a shape used to override an...
MAL-2026-18294 Malicious code in @capsense/ccx-welcome-page (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f63b73ae5e707b0eecee16f97f8ab26b350d135547448fbf6e005ba33303060 The package publishes under the @capsense scope at version 99.99.100 and wires all three npm lifecycle hooks preinstall, install, postinstall to run...