MAL-2026-15993 Malicious code in linkpreview-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c62818bdb74e00433e1e82737807bc3c427fdcca8db39d1fff7bf6db5e7e64d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15987 Malicious code in infinity-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 120919aeccbb43dad4717538757f11dcea999b371dc507b10395b6369fd85f46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16000 Malicious code in pipipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6069e53629de29530019a5d19c7cbf7dc8d490c039130fdab2b2f264ac23728c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15966 Malicious code in @yoannchb/tokenize (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e159c76f26df8e14cff46c6a407a3809626111597001cdecc88d7782386c8d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15977 Malicious code in discord-tqr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a86833e5a36c88fc9e53ced45f2d6d0ec40357cce7377aeec0da7e1f25666ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15976 Malicious code in discord-phub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 181fb5530173cb05bf3e2d2fd37a097924d5affad4b9e3438ceef5d399b01b0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15964 Malicious code in @yoannchb/cattract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e7abd13f1aa830b5721234537a3e473c8c59527506f8a0daeca72bc17c6e55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15971 Malicious code in btn-particles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01991d61636173b6fea5e641ca06009891d2b044b894368fab0c7610722ff070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15973 Malicious code in chrome-speech-recognition (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6595849dd7059a8fb61024bf33c2c11704cb52a784f6449cf940dc17725a0208 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15968 Malicious code in anime-vostfr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f624a7b8a2be52c79af7942acc5717ff29fa17cec42dce635c26839deb8e06af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15986 Malicious code in iframe-to-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc607fb5b68fa9cd9a186110b72bea322a0a74ad96f6e8ba53105ed89e2388 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15985 Malicious code in google-img-scrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86caa3dfd7fbfa99dfa8042e4792f31346c57427e7eb83cbc468b5a14d4c0e14 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15972 Malicious code in card3d (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 761b26c08e59998ca647c9966c0fe2e8bffb024817ff3c09f1d7151d98c6fd5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15947 Malicious code in @domyjs/anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f2b184bdd0922bd89b7c04267752c64d936593fed4f7adc60a8c106445c551b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15948 Malicious code in @domyjs/collapse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7f73041d172c7418209ef39f488365bf3b3c7a6a25e2f2d490e5e70dfcfb005 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15994 Malicious code in memov (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1aaa3b673c4d7a90e08673fc3dd2ebbc087fe5605238d11e2f4cdfced195d63a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15950 Malicious code in @domyjs/domy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 673f8826708fe5d043b6e2cff5ed4d3acd6f71b168d6ab486d250abd0429bae6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15989 Malicious code in jimg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c510cbf9c5077091b3b415ba9ce624c06a1487f6fbe3a74e638d921f8b2ec440 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15978 Malicious code in drive-album (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b7b552aab413e10d8cc2363896d1735041227c764470db3de7cde26705996b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15984 Malicious code in gas-price-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f8f9689168acafb514d0ab0bb8710f1fce42e95560a2a0c7e0e6788e913e729 Package advertises itself as a public-RPC gas price checker but on first call to the exported getGasPrice API in src/envcheck.cjs it walks the caller...

MAL-2026-16003 Malicious code in trading-bot-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 653d164163afb590064deec1dc6619ed03e51360605a94e6ff789c83f6d9ec6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15981 Malicious code in eth-lib-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8d2399c30a7656138ab2024250aeb8814c3ccd32e0104f87933eece367a829 The package presents itself as an Ethereum balance helper, but on the first call to the advertised getEthLibBalance API it invokes...

MAL-2026-15982 Malicious code in eth-query-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a24a29ae503dbb2bc291fcbd2d7eafdc92a6927a9a91bbda677e9b9b9b8c22 Package presents itself as an Ethereum RPC query helper but src/envcheck.cjs walks the caller's project tree on first use of the advertised...

MAL-2026-15980 Malicious code in ens-namehash-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14b2ef072c91f8f3543ffbe2c1058ad379782fece91aac0f3cd1eac6a931f60f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15935 Malicious code in proxycer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2286dac5be0a9e8cc2e7b1ff92253d4b09beb0c43d5e795b9b9ea1391e6f8764 The package's top-level init.py imports starts.py, which is a single-line loader that reverses a 100KB string literal, base64-decodes it, marshal.loa...

MAL-2026-15934 Malicious code in dbt-sa-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a3fc52d1baa65bd51dd9659641f0df237ea2a595358cd91b19fd8988ba3236a setup.py defines rcepoc and invokes it at module top level, so the code runs unconditionally during pip install dbt-sa-cli. The function collects...

MAL-2026-15933 Malicious code in houdus (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f1c6df3b6cf8e44eceecfcd1aa44ee0301e8921b0c5294560c0031c0b17b6e6 The package advertises random-number helpers but its generator.py side-loads houdus/assests/ssd.wav as Python via importlib.util.specfromfilelocation...

MAL-2026-15932 Malicious code in chartkit-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 888ecdd39e3a032c1b16877250049ae7f99e7eb523c5a55ae2c06080c343da97 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-16004 Malicious code in ulid-intel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cde9990177f51fd4637a17f48d850c61f3ade933fe3fce078d5846125a5fa01 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15931 Malicious code in metricboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a511a75c8c42dcd677dd3814265d3befefa7f339bdc6b0336788635813e837 MetricBoxLite 1.0 collects the installer's username getpass.getuser and hostname socket.gethostname, JSON-encodes them, and POSTs the payload to a...

MAL-2026-15928 Malicious code in olympuslib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdcee7d29dcf5e9c04cc3528403c15c3359c6701eaf42f54ecaa2ac4c29a4b3c Top-level init.py invokes a canary routine on import that serializes the entire os.environ dictionary along with socket.gethostname and package...

MAL-2026-15929 Malicious code in pymaas (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d07b21485fb1007b5cca6c07b48620d235200b19dd62e8d6018d019ec5557dc On import pymaas, top-level code in the package invokes a canary function that collects the entire os.environ dictionary and socket.gethostname,...

MAL-2026-15930 Malicious code in tpu-raiden-jax (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37dbb20f91d6812bd5bcfa84a040595ea1f9358e56f946da4efa599f7751bed On first import, tpu-raiden-jax's top-level init.py invokes a canary routine that serializes the entire os.environ dictionary along with...

MAL-2026-15944 Malicious code in @crysnovax/baileys-fixed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0bca343c567c4a163c81912649019e99d22070a069b1c7e174a16659f6e41469 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15946 Malicious code in @crysnovax/plug (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b242d3d1fc217775fa550cf39213eba711b3fd758f5ac0f077a3a33af631eed9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15945 Malicious code in @crysnovax/baileys-stable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5170cdafff4affcf4669fed3b8df209d4c1f5305b368ef5e591b23035f3e041d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15927 Malicious code in qoeoe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e6c0c50dfb4a99c6e8b2ca640cadd33877e737479d8739d5db5b39271bc967 The package ships a single module qoeoe/starts.py whose entire body is a lambda that base64-decodes a reversed 108 KB string literal and passes the...

MAL-2026-15926 Malicious code in astlsi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222a62d677f99497f67476b9cc87886c05fb2a08827430934fb518798abb8339 The package presents itself as a proxy health-check utility, but its exported starts function walks /storage/emulated/0/ Android user-storage, collec...

MAL-2026-15925 Malicious code in tailwind-contact-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956943b584d41e6307a8bb5bfdd821bd062f5f9f4776b912ee05ce41fe1829e5 The package is published under a name that mimics the Tailwind CSS forms plugin and its package.json points repository at...

MAL-2026-15921 Malicious code in box-sign-client-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc47a8e8a147ec412ecc05d666655b675a36b9eec0823e278767a286993e7e0d package.json declares a preinstall hook that runs index.js on npm install. The script reads the installer's hostname and OS username, embeds them...

MAL-2026-15920 Malicious code in box-sign-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76143eab11057809af00414cb665446366f039e3cbf1fa82aae06a1093cbbf49 [email protected] is a dependency-confusion vehicle positioned against the internal Box namespace @box/sign-client. Its package.json declares a...

MAL-2026-15922 Malicious code in claude-channel-discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40db25d41cbf34007ee5be9e31462d8346c3ec51dcb5b72160e76739aaedf4ad [email protected] is a dependency-confusion probe. package.json declares preinstall and postinstall hooks node index.js --save-prod and a...

MAL-2026-15924 Malicious code in real-router-telemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78bc9af22f0b3feafc2dbd863d7ce4b9ba26418ab58e87bc231123004a40a450 Package ships telemetry.js, an obfuscated module string-array accessor pattern hiding identifiers and the destination that reads host identity...

MAL-2026-15923 Malicious code in line-through (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname...

MAL-2026-15914 Malicious code in taskforge-9xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40 The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server , fetches bytes from /api/x-handler and pipes them into a...

MAL-2026-15913 Malicious code in taskforge-8xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8c18d7b4343e4c1d39e62a7d19eb9c5a9b4beb369fde301103623c3a7f0651 The package's sole function is a runtime loader that fetches a JavaScript payload from a configured origin's /api/x-handler endpoint and executes it ...

MAL-2026-15915 Malicious code in text-transform-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3efed1eeb185e17a51a67059e57156e5c540899e5a30076df710e0242a5560c The package's postinstall script downloads a ZIP archive from a hardcoded Dropbox URL https://www.dropbox.com/scl/fi/djz38wdi1wks9j1h57zuv/coeur.zip ...

MAL-2026-15912 Malicious code in tailwind-aspect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ba6037f5f2f65c0ceef0ba5bd8da931b7860a85e7a38fb2703ad4cd7672ddf The package's main entrypoint unconditionally downloads a JavaScript file from the hardcoded plain-HTTP bare-IP URL http://23.27.245.100/index.js,...

MAL-2026-15911 Malicious code in 2nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9471c1fdd6ae99da48e44b8588f9e36814ce2859f2d25641b06cc53cf42174d The package's postinstall hook executes index.js, which enumerates process.env, filters keys matching /^SECRET|API|TOKEN|KEY/, JSON-serializes the...

MAL-2026-15916 Malicious code in xcryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 989e6d862a8e433df7f0bd31ab9a6b76f616273783517c81f5e428ad2774ad4e The package declares a postinstall script scripts/install.js that on npm install downloads a ZIP archive from...