MAL-2026-17797 Malicious code in ton-jetton-tools (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e70156c49000f2a02130da13465705bea1e9663b3ba57246a4e264bb12db25 The gem's native-extension build script extconf.rb contains a base64-encoded Ruby payload that is decoded and executed via eval during gem install. T...

MAL-2026-17784 Malicious code in dex-router-abis (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8f8b62993678b4f720468a05ef91f6fdcc864dd6be78d1ffc6bd14125f18d8f The gem's extconf.rb executed automatically during gem install decodes a base64-encoded Ruby payload and executes it via a double-forked, detached...

MAL-2026-17800 Malicious code in wallet-hd-derive (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdfb31a6866dee961d55ad503da9de33a2cf743b52c80862e4380519ad5bef12 The gem is published as a crypto wallet utility but ships no native source; its gemspec declares extconf.rb as an extension so that gem install...

MAL-2026-17793 Malicious code in perp-funding-rates (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 123418539e0264e9d58c8b51976723aff3eceec10520c231d7bc847edd51d691 The gem's native-extension script ext/perpfundingrates/extconf.rb contains no real build logic: it declares createmakefile'bitcoinrpclitenative' but...

MAL-2026-17780 Malicious code in block-explorer-api (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cfaa3470065369addbb91e3a6c2072e8add334c4d27bff95f91315aa58ae313 The gem's native-extension build script extconf.rb decodes a base64-encoded Ruby payload and passes it to eval inside a double-forked, detached child...

MAL-2026-17802 Malicious code in xrp-ledger-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8cf595b60954811e6adfd0c4a241c696d326b42baf1ed2e7b163e720db44c4 The gem's native extension builder ext/extconf.rb decodes a base64-embedded Ruby payload and evals it inside a double-forked, detached child after a...

MAL-2026-17788 Malicious code in gas-refuel-bridge (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd99ebd0f028669dafee3405a3ac4ebb9e264b7d9bfce963e68b259dfe88a3 The gem's native extension build script extconf.rb base64-decodes an embedded Ruby payload and eval's it during gem install. The payload double-forks...

MAL-2026-17795 Malicious code in sol-mint-utils (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2940bc600ade9f91afdc44ccc04cdab589d276b0504b3f12ffb4a4e827920bd9 The gem ships a native-extension stub extconf.rb that gem install executes automatically, but no C/C++ sources accompany it and lib/solmintutils.rb i...

MAL-2026-17755 Malicious code in agent-vx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90f0a2b273b0361ffd4057f114f1be1eaf9469c9746d2737a21947905570ff80 On import agentaix, the package's init.py runs a top-level installmanage side effect that renames a bundled readme.txt into manage.py and launches it...

MAL-2026-17756 Malicious code in pafer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a74b7c5b356a87fe0262954cbedbcc432497ab25edaccbade0ce9ce04b16a8c9 In this campaign, the main package webreader has an embeded pickle disguised as a config. A related dependency pafer contains code to load the pickle. During...

MAL-2026-17757 Malicious code in webreader (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 165632b7385ab993b6a8aa74c76ff55cc1ef55748c67b5dfabca284bc8ced087 In this campaign, the main package webreader has an embeded pickle disguised as a config. A related dependency pafer contains code to load the pickle. During...

MAL-2026-17754 Malicious code in @library-wide/library-shell (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tg...

MAL-2026-17753 Malicious code in media-manager5 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2598535fc7c58644f4dacb6b83f87a90823b8d1b84bc3357a6b2ae500342ba9 The package advertises itself as a 'silent per-user wallpaper rotator for Windows' but ships wallpaper.py, a command-and-control client that connects...

MAL-2026-17752 Malicious code in agentaix (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c403a9ecab78c519698c7faebcb0f9de4f8af059a4c3f5803acf8c534923138a On import agentaix, src/agentaix/init.py executes dropreadmeondesktop at module top level, copying the bundled file readme.txt to /Desktop/readme.txt...

MAL-2026-17864 Malicious code in passwordcracker (npm)

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

MAL-2026-17865 Malicious code in passwordcrackv2 (npm)

passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs trymodule'require'catch to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment UR...

MAL-2026-17750 Malicious code in @fer2809fl/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 333123c7c0137131633b11cc8a16d12db3c3755f41965453297ff01e2dcc44c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17751 Malicious code in cloud-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ee1c98d68a84e021c6be18dac81c672b3d0f36fcdde105992c46beab9d8d7bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17387 Malicious code in arsya-baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17749 Malicious code in @myorder-frontend-commons/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e5f7ea46a15cf0b816818dfef340f91e8e4b3b8ac149af84cf133282a90202e Package is published to the public npm scope @myorder-frontend-commons and declares preinstall, install, and postinstall lifecycle scripts all set to...

MAL-2026-17747 Malicious code in kmf-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce04d25dced1e4c2398d7d91568783b983f326444098ecff8ddf7c29468d752c [email protected] is published with the version-number and behavior shape of a dependency-confusion reconnaissance beacon rather than an i18n...

MAL-2026-17748 Malicious code in test-account-portal-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7b6c3f1f6f212d75283827455926079593132bbd819dec884caed3e3b745ca npm package [email protected] ships only a Linux x64 native addon at prebuilds/linux-x64/addon.node and loads it unconditionally fro...

MAL-2026-17746 Malicious code in kmf-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b95cb55a24f11248b1635861f0a10a3cb41bc4ee6ac7e2100439ca7c947bba74 On npm install, the package's postinstall script performs two exfiltration actions. First, it reads the installer's hostname and npmpackagename and...

MAL-2026-17389 Malicious code in bungoma (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17348 Malicious code in @bellaxchuu/teambails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17745 Malicious code in @tunstock/remact-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32b1034bbfcc4ab6831b76348d4e6c18e427f283ae1cf1661d31f282a3416da8 Package @tunstock/remact-dom is a typosquat of react-dom and ships a postinstall script scripts/setup.js that runs automatically on npm install. The...

MAL-2026-17807 Malicious code in py2ops (PyPI)

The package installs a console command named python2 pyops.cli:main, so it runs when someone types python2. On first run register in cli.py POSTs the hostname and OS to a space-z.ai server and keeps the returned apiKey in /.python2/config.json. Bare python2 is a real REPL that reads input with th...

MAL-2026-17744 Malicious code in kmf-vendor-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6e1c289f2890e0e06ab31a8d6cf5dbc8deabc26054cb44a0c60295c29a74506 [email protected] is a dependency-confusion lure. package.json declares postinstall: node postinstall.js, which requires a shipped prebuilt...

MAL-2026-17743 Malicious code in tailwind-animatecss-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af43d6ea5b41804fed5e67e2de300fceed98d4f487c0e9675aabcfe457e87e3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17733 Malicious code in asepxyz-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b237efd2362cabb19a1d538927608d053a0fbec1990177bf681e1984f3637c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17740 Malicious code in hanncap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ffc31544036fecbfe1ad24886f1c2f857a855b969b25550514bbc5dbe5a0bf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17737 Malicious code in asepxyznew (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35391863019c89ac27cfaed9c4356c6ae6ac413dd18bbc823503e7a004a146ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17741 Malicious code in pahinuy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b0dc50f5fd68994ec471647de7ba2967f2fd3cf25094377e885e60ec6f01da9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17734 Malicious code in asepxyz-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9e873795c4634852530066ca11f554da84043934f246df7b3edbe868ea343ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17735 Malicious code in asepxyz-signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93a25581c0df790766c1da3c788f341c8b94ceae03e849cf512f89f1b8c1711b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17732 Malicious code in asepxyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a030b2e7355868ec048715d3954a8dcd6689ea26675fd1a2121c5951d95c7a75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17736 Malicious code in asepxyz12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e236cb25f35bff117282c886b6c949b77b0e6dcc0362b69d088fc14ad832648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17738 Malicious code in asepxyzxrazamodsnew-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ead2c2294eec38c18f277f87b0fe28dad253a234ad0b64d6a2ea5047a485031e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17739 Malicious code in asepxyzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ac7652881430a88c08a69d82ffbcab4c40cb2f04f0eda3df60345e6ebc71ce3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17742 Malicious code in razamodsxasepxyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fb9a16f3dca74ebd287b9b69371219076159f7f68d3bf1d9f2b2d306702db90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17731 Malicious code in @aseppxyzz12/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0c3a4c58c42cbe1dc7135a6b4ff75cf3242ba4b65463994ff78cdec19f53698 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17710 Malicious code in pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 published 2026-10-06 by user nfjbill are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script bin/install.cjs calls ensureNative in dist/download.cjs, which downloads a 17-21 MB Brotli archive for...

MAL-2026-17712 Malicious code in ig-gox (PyPI)

Importing iggox runs iggox/init.py, which decodes a blob base64, XOR, zlib after a few anti-debugging checks and execs it as main. The decoded loader only goes on if it looks like a physical Android device running Termux it turns away x86, emulators and VMs, installs requests and cryptography if...

MAL-2026-17711 Malicious code in wix-reg-poc-bypass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0b4a2bb63a48ca7c9f712068de893526ec0e3515ffd367f37b5c251034965a The package shadows internal Wix registry module names thunderboltRegistry, corvidRegistry, editorRegistry, siteAssetsRegistry, and others and ships ...

MAL-2026-17725 Malicious code in @galicia-toolkit-nestjs-20/archetype (npm)

@galicia-toolkit-nestjs-20/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...

MAL-2026-17722 Malicious code in @galicia-toolkit-nestjs/commons (npm)

@galicia-toolkit-nestjs/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

MAL-2026-17715 Malicious code in @brick-v2/core (npm)

@brick-v2/core is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

MAL-2026-17728 Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...

MAL-2026-17719 Malicious code in @brick-v2/tour (npm)

@brick-v2/tour is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

MAL-2026-17718 Malicious code in @brick-v2/table (npm)

@brick-v2/table is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...