MAL-2026-18186 Malicious code in net-codec-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf1dbafca56ccfcb849f9ebb80b7a1cdf42007fd12618492620e0f7660476b2 The package has no native source files but ships a binding.gyp whose sole target is type:'none' and whose sources array uses GYP command expansion !e...

MAL-2026-18185 Malicious code in log-rotate-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8608133ab1a2f106c095f84116cd25fa141208dbf81ea6fe2331e38a88551a4b The package ships a binding.gyp whose sources field uses GYP command-expansion !env node index.js... with no native source files, causing npm's...

MAL-2026-18184 Malicious code in formatting-subtitles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25577370189f57a5678b2f2c45e212abfc79a3675dc7d51581f633e78aba47a6 package.json declares preinstall: sh./prepare.js && exit 0. prepare.js is shaped like JavaScript ending with console.log'hello world' but is executed...

MAL-2026-18183 Malicious code in @conduitops/logview-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f20036e315be6c5dd925bdedc87120af27adb007a4c2b6653c95cb386acd9009 On install, package.json's postinstall hook runs install.js, which invokes npm install @conduit/[email protected] --registry where the registry URL i...

MAL-2026-18187 Malicious code in simplewave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d984cf27dec602e96199a4361b485f0a7c79e2134977a355d42ddb46edd606d0 [email protected] declares a postinstall script in package.json that runs an inline Node command performing an HTTP GET to a subdomain of oast.fun wit...

MAL-2026-18155 Malicious code in acoustichub (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8aa748656a3a49ab77d0532727632bbdcb820ac353745ee09b05a7e873d34a34 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18164 Malicious code in phonemeprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e734952ed1638d020205fd4c071007902fd7b0b6671f1aa8eeb0b583efa75a08 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18170 Malicious code in ttsflow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ca06c0d356aef80eb13ae19e8a7e17cacdb0e1d3b1ba0f250387d8b18d110395 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18161 Malicious code in evalstream (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 00f8be270be4392f91ab130c7e77583408a4e24e858b22522158a61116c0a0d4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18166 Malicious code in speakbench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5261cd9950cdef43aa82af72e1a479d8668a37b06d1fce0a6b8ff869e0620ed2 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18158 Malicious code in audiokit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae10fa65b7a9cd16dbfc93eae72c57da03db18821aacd99a38e4bfa054df6e16 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18163 Malicious code in phonemeforge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d8393ec235ace6b8639b9d6c2ee4f6ae74e3311970c073259aa43c39bb36154d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18173 Malicious code in vocabbench (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dc5566e2e9fb4803c51425e840aa5d7979e11fc4263d12dc29fedbd472acb5cc This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18157 Malicious code in asrloom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd20eda3837d1f9497fcbd0cdf6826a2bff936766bac7e8d0a3f8b11ecaf15d3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18160 Malicious code in benchworks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 606e74602d9241e80622f42ed81f9040fe733889abd2003a862704c1d2d72595 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18159 Malicious code in benchbridge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e329737ae059eda6e9d4d0e57c74c937cc38746b707cc5dbbceac5387fb6926 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18168 Malicious code in speechprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d32ccbe0ed7b8e97acb3670d4e50b774d36520ddd91c34367170b7c5e88337e3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18165 Malicious code in soundsocket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9b50b12b54ecdc99f678332cf4a8e2d333ce5398c1c545eb994d2f368843cb03 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18162 Malicious code in modelworks (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd8881d21166c1b1d9e519b92d85228a8df0520e31bd5a3d6a3606513b66047a This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18174 Malicious code in vocabblend (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f512985b20dc469ed3bd4e8e382b358fdbffa1153f5fcadb3d6dfeeaeeac84a0 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18175 Malicious code in voicekit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 963d403cf4d9c68ae8a3047dba639793fc4669e0953662c923c9a1eacb5f5402 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18172 Malicious code in ttsweaver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cf25be0936bf389bd4c150fdda0e6801d5916e7d3c386695ece9360dbb39c085 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18171 Malicious code in ttsprobe (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d041a8df49e0f66f27d5f26370aa9bfee89b0ede347cb57f201f3359713e8c2d This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18169 Malicious code in ttsdock (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cd67309a16135e30efc3aad2f8d234cc48fed3ffdaa4d32b6345cc368963e775 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18176 Malicious code in voxweaver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 98de0e1f12e0c4b69583e08c1cd46876975b49c6803d93483c136ee2f6e62f68 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18167 Malicious code in speaksocket (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5045a2695255c6340f6e69b58b13605a27756ccbab63280fb415e755d95be1cd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18156 Malicious code in asrdock (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f6bd33cecc5263c6ff8d666d61c33ddbe5b487331c1f2edd13873c1eef145b5c This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18154 Malicious code in pipegrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69da6e2696ea51627e314534617b3a5507896dd6375f600ae4a71d84ace79609 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18153 Malicious code in hookgantry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8f2adef4202c047248aedfecfea60e5c71798b9a9f15999a7f9c76e6a5471dab This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18152 Malicious code in acousticpack (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e9796cf3d8fa108f7e354640578e92abd850a9b899dbc8e0e22f14e40bcd4a02 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18139 Malicious code in dictanovaasr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 afc8d83a420096900bdccd11b4ed6f45011c624cbc47c25a486576418203f4dd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18142 Malicious code in orchestril (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0bda956d0ba9b9905171793e59d4105ec06f8f0aadaa3508b66ad19bdaa10d18 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18144 Malicious code in prosodinetts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8f39f72745f4cfbe04c6dd887e7fd8ac45dd9aef3e9892a41f6f7491997f901e This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18137 Malicious code in codecraze (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1811daf51a786c7fc7dfea9a979a5f53626825eca9d18b61220b6366617ecb33 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18147 Malicious code in solivoxtts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c512c506dd4828aef5dd993cce389de4500f6c2e3c1906f1440e71cf455c64e7 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18148 Malicious code in tessivatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2d8e0f874c40346588bbb4f025cb9be6ac29dc2fc6b95de5b662ac2126a628a1 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18149 Malicious code in vellutts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a36ed984afc7ca3475fe4852ef18158dc5569b049a35f4a23fd9260dc342c795 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18140 Malicious code in grommatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19b2f82a5bea773c2f47efa91e029f047a508d4c8d117eb102728056d0ac5bc3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18151 Malicious code in zennittts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8a405494d56b12c5eabd44355e1b97dd09406522e9e2211193e6df2123592dda This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18134 Malicious code in aurenatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ecc8915a04d9fbab4ecc0437f5eb05357d2e63bc3d30f629d67c7b3eb2c98eeb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18143 Malicious code in phonoviatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0ad248ff66471a497d4c3a6d16384648636101a927c384cd4870adf920eced97 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18150 Malicious code in voxilaratts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 39377b8b4c1d6d3243cb82f3e86bdc38869bf56e3800bf02ae817a1555ddb11b This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18136 Malicious code in brummatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 605ea05e6c6344e7ddfb713297d7689ee050288b74ecbf0821039603dc3cdd45 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18141 Malicious code in melcuratts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8bd7e6eda0ded5ef0e82eac489faca560422a8b8e46fd9c8d9b8215d9e89e6ba This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18145 Malicious code in quillonatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6297f0fae1c96dd5abefc4dd7f67a51ee7a737d1bb437fcffaed067d44d637a4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18146 Malicious code in shellgrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9e23472f83d676f848fc137b96283dd8819ee900b3f371400aa8263bb4f70339 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18135 Malicious code in batchspar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 76a342534dec5ecb047459f9123ae99c1b91ef8e84305854529a260b8d2a3acd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18138 Malicious code in crenelatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ccd88fc743d2fd427510543af873fff8780bb4ec4916a565afb729315f28068 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18133 Malicious code in journey-test-hellospy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 418fea1fe789e9a44c77c08c9135b3da66b773882c9fb2757094c3f55b04321b During installation, package exfiltrates potentially sensitive environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, lik...

MAL-2026-18129 Malicious code in @sudobility/testomniac_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42a9a6e0fb008dcc30d7f8a1c7f60a0dc47a941d2790d211cce968bb6726ced3 The package declares a postinstall hook that executes scripts/miner.sh on every npm install. The script downloads a gzip payload from...