MAL-2026-18096 Malicious code in workalender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb4f2824499fd64a22d9dfdb23c454bbb8797422f5281fdd5f454ea64095853a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18094 Malicious code in pafex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8ad1f51a6f081ac9e46b3d3ffa2d0b9b150b1600caf826d940f4e3d1992cda16 In this campaign, the main package resion has an embeded pickle disguised as a config. A related dependency pafex contains code to load the pickle. During...

MAL-2026-18095 Malicious code in resion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e9e3ce373adb26e45616eec47d727e557f5a696737cb2fbcaa66fb7dc7b7c3e Description: In this campaign, the main package resion has an embeded pickle disguised as a config. A related dependency pafex contains code to load the pickle...

MAL-2026-18093 Malicious code in workcalender (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa This package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this packa...

MAL-2026-18092 Malicious code in test-workalendar-internal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9f36e976d0fcf254def6da62e0090bfb2dbdf76176ed316655574408c25cb9a0 During build, the package creates a web-sharable terminal session and exposes it via a Cloudflare tunnel to the attacker. --- Category: MALICIOUS - The campaig...

MAL-2026-18091 Malicious code in @platform-services/hrm-mfe-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7552efe145088950a0df7a5c63da92a309a040fba2062a4d32bb59cadc9ec47 The OpenSSF Package Analysis project identified '@platform-services/hrm-mfe-core' @ 99.9.1 npm as malicious. It is considered malicious because:...

MAL-2026-18064 Malicious code in sc-announcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43 The OpenSSF Package Analysis project identified 'sc-announcer' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

MAL-2026-18063 Malicious code in fanarena-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d81686cb5b877d15810946a299ba819a875a3304e45d65a3fdb83c5473ac664b The OpenSSF Package Analysis project identified 'fanarena-common' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

MAL-2026-18061 Malicious code in ccl-global-shopping (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9 The OpenSSF Package Analysis project identified 'ccl-global-shopping' @ 99.9.1 npm as malicious. It is considered malicious because: - The packa...

MAL-2026-18062 Malicious code in sc-wizard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 54691cc130e614ee031186f7e646c3e6076efad6105a6e9cad68f62aa736516b The OpenSSF Package Analysis project identified 'sc-wizard' @ 99.9.1 npm as malicious. It is considered malicious because: - The package...

MAL-2026-18052 Malicious code in @an1mshnpmb9c84920/stage-repo-m19g7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8cbfe397020934cb02a0dcc611148e298b534bc293b988506a9b98283b635ca3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18046 Malicious code in @an1mshnpmb9c84920/gat-scope-target-125ec19a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a6c3e813249e8507231bae9ca9fd4f2c87c5781e8fc492e626a7f6ebffd97dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18050 Malicious code in @an1mshnpmb9c84920/stage-fn-m19p2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58652b6f2ce0c4a88745450ff9578775a361e8bf9b6bc6bc4fb257df4e2cec75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18051 Malicious code in @an1mshnpmb9c84920/stage-outer-m19s5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e22ef211e45af7c3d9cff848109a5be4ee4a70ab7b0eedef9551a55f29f9cdc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18049 Malicious code in @an1mshnpmb9c84920/pipe-dns-m19t2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0af2574cde6941a12e82bbc6fb4de1d1fd75b2434ab5e88dbebc4e8ea644bd36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18048 Malicious code in @an1mshnpmb9c84920/pipe-compat-m19r8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e68a8bf50beff0920ea061584da611162965944dfed95fbfcf2e652b17afe57d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18047 Malicious code in @an1mshnpmb9c84920/oidc-cross-cafb9d929e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deb8f5f8a141f2fc42944c07f61285ce6a20c2fa6e57a20fc1e4994902288023 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18054 Malicious code in @decoopus/claude-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9c714cd8ba4dd623d5570083b71cdbc76991794df7b81833c282793dddfcbbd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18060 Malicious code in codex-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07bc1e933aeccbce3ee5ffda504b2abd81e6e8c9d09866d7a8e5c6197d7873c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18053 Malicious code in @decoopus/chatgpt-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef73cfc453d6276dbd5b19b5ce5dcbde9c60f17cddaefa47d54c1cf8e248075a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18056 Malicious code in chatgpt-desktop-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7551b6bc0def507896edf6f75d5fe99a46d27eedbe55f69861c500b3c07551aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18058 Malicious code in chatgpt-pro-setup-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24a0f02e78844e79a4df58507500f6814fc423cebbf3894ec18f29bd019741de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18059 Malicious code in claude-desktop-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a630106ca43afedf49fdba82514ad1acbbf35a504b68e9d14d297006b82d6ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18057 Malicious code in chatgpt-pro-activator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4036bdb1e865d1711f96c2625d79ae7d103139b082dfd5d3410d89aa64cddb4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18055 Malicious code in api-anthropic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1922723e10fcad576f383d44d31606460edf694315338ff529a20a84add0005 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18045 Malicious code in asurion (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 05820dd77e1f73d1a01797af6f10c6fa4ae22038be3fcd6a8cbd8c117cf6436c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-17943 Malicious code in vinted-mocked-apis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 55332d91b2afbf62923f1d853c6df3a5c8f768797a3176effdecba07b91d4fbf The OpenSSF Package Analysis project identified 'vinted-mocked-apis' @ 99.0.0 pypi as malicious. It is considered malicious because: - The packa...

MAL-2026-18014 Malicious code in g8ez1y (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 856f3df734d3c4ba733de7d080de9db9101e58ada25a85c5ff2f2de31e821105 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18019 Malicious code in j5opb7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed97bb84a3c73d0403281a21f9d2caffa8e3f79d45e9e7d581ae17a97366aae2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17948 Malicious code in 4p9kgm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8f8dbac66bebc60314751343a9bda1879c43aa1f79c6431209ba5f05feae87aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18010 Malicious code in f0klcr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware caa80df1053502db139c511d6c4e93d499285171c69e2a5c551bf60ea2baebf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18011 Malicious code in f4iomt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 990d68202ea212791aeda4f4caf3430e61a1e66b74cd959f19483c69b3a98134 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18017 Malicious code in ivzlid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 148c46c6b04123cbb5fcebd9799d2bff4500222dadc3487f899fa2b3eec1973d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18044 Malicious code in zubn7b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7061ccce07debb68490a0d8a26e9616d2cd7b373bffd97ea3368c6a4df154db5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18018 Malicious code in j019qc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d6d4a015008723b12bdaa1902079ad606e6639a67a9b897b3f41c0b6d80911a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17946 Malicious code in 3gr841 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88c0562bbf64a1edf09d03d9f363f2f1289b21a0a0458a11f9f23b5994dcb29e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17950 Malicious code in 5xzkuy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d82ada11187121287ba6312bd27d6f1ed19d08c1a04ebb9fd22b9e20daa46ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17947 Malicious code in 3qamjp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac51b55c001ee9e4f4d9929048b399ca2060752cc6bb729421125504a4158d9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17945 Malicious code in 3gr2dj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d22fac2aefcc35b1e53218b222078517b198a09f3264326027a3772237787136 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18022 Malicious code in lstsyw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24aae4779b01bc55ca1517a5cb8a293fb271fdc84d0faadae42b7cb5c2d0ca22 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18039 Malicious code in waojpf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 840c0ad6864e7cae8598996cd33dd2344ad8f66a9c4aea0dab5b56c8d7c78d45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17944 Malicious code in 1n9lip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e7b34a7eaa3dbb8861410d418446aa097daae3af5f2dba8ba54a81caf49203d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17949 Malicious code in 5k5t5q (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19ce28ad8cd41f84573f786d9939d4f707f0980fbe2060ef81803600bf506c69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17971 Malicious code in aqj3w7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 85921c0679fcc8e9ac1d8ae68221dcbc5e15d669cddf9a7ece74b06939472cc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18036 Malicious code in rvmbnj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7cf73b31b714e9fe31fc4fd86b4332c8a419b0bbee4bd103ab59dbc01ac2ec3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18033 Malicious code in noe77e (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcd22aea2eebb1b205ce8a1395cf700f483e7171fda32dea0bdede31be310eae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18034 Malicious code in oo9fja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b96948b1b1f5a6c67ebcd47b4c506f715d7c29c10a53ac3e1f91f88e9f50edb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18037 Malicious code in tkacg3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ca526f75727afea69a9783166ff6af32c1b7e7125e1bbc1c84f05c42c7ea114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17951 Malicious code in 8h66ok (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fed0176448561ecc73fbfa95c5a88a4d84b8997922fbb9b1bb414db10a4e42f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18013 Malicious code in g23p4g (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f3777aa622f3dacc3c2613ca9e21af9f5dbd67541805fcc0536ce658bb0ec07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...