MAL-2026-18242 Malicious code in sitecard (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 49be8995374d0e3d2bcb8f163675221e14bfb6d7d968a6fa5d8165e4f493997d The package provides code to create an SSH session exposed via tunnels. By default, created session is accessible without any auth and reported to a hardcoded...

MAL-2026-18228 Malicious code in jobwharf (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 172e672abed0eeea77b62d2a9dea9999b59ff685b952fec68c70e2b227e0bce6 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18237 Malicious code in slatejob (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 779bcb94eecf53cfda39d7bfeb12aac9de072d14b22904a6f7bf55e33c3e5e7f This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18234 Malicious code in reedworker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f309ea93245f05b07163de9b85a0e47dcd64eeaec705794c502b21429eced883 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18231 Malicious code in loadferry (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6d5ed5a4ca84e5e36cc5a87ee1ef6652bb96f1dbe1ef3340a041060c6bb9f477 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18235 Malicious code in runpier (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ab469bbd671fcc96fad392de06c7652a4f9ea899df3c86d285397bfc3985a690 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18236 Malicious code in sedgehaul (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1eccea61ba89da6dd32ddad1e54e70f52c5a2b2c9aeeced8a80e068ef63dccd4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18238 Malicious code in taskquay (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 692f4bcca72a6b53c989001619446e8b3b5bd66716674ca8230baa6d9d4c60a5 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18232 Malicious code in marshrunner (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 689d5b87d977bc368c98efb8cf42d53c25465575a667cd61337bb403dfdcb4fb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18241 Malicious code in workslip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6a509c00601b9f218feeb0cf12a7f84899efaf786edee659338d53d9888aa507 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18224 Malicious code in brookworker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b5143967b27cd16bb4d28cbef2272599e90443b5f651a57e8f42d32c2e8b4ce2 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18225 Malicious code in cobbleload (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9cf9dcc227e75e864e1dffc62bc95b8d0f73dea45b088ed34ab718a8ab87fb08 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18223 Malicious code in brambletask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 922435cd67a39583e0143229da6822f691940fcea9f4b4b18203faa594a1debc This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18226 Malicious code in ferretqueue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 00f1975c33600ed4869f6783ebd8d73e93e3a25f293b4f724ab2f4af2b1c9096 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18233 Malicious code in otterload (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6860fc5e0584389884eadd8bf39289d71d5c8c6dc01ca64603f3af344be8d755 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18222 Malicious code in badgertask (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ad613b4be626131dbf5d5cdd0e6d63ca39c89165c96fe7fd152d8d781c4573ba This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18230 Malicious code in larchworker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 87e174c9dc2485263894e4d6c3d1560589659afbfbe9397ca1e1b53fb21d96b3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18240 Malicious code in thornqueue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea756029aedec54cd447267056236a9c4a6752d1a9973198ebf71c300fcd9112 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18239 Malicious code in thistlerun (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6c35afe278e655040c47dcca9e63b4ab75c1530880041568e544700daa20e887 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18229 Malicious code in juniperrun (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1fd79c13a84952cbede2a1b1de7ba5d43396a2c95866015cdf73c9ce0d9960f5 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18227 Malicious code in flintqueue (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 603240baf11c5a5c77d3a008dcfad49b31026bca034692ecae35780a6f0e6855 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18221 Malicious code in kestreljob (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4a86144582538adae41c5d2f14f22daae1f65ecf9b93cdeb0d82889681af9222 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18220 Malicious code in skillward (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0f3fd922178c06b3eae3dfaaa0bce1469e7c2d70a010a6263b117e36874a72a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18219 Malicious code in onsokets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 844774819aa502a53d6d364b6636fa62eb412fe8b30973c226aeb9b7b89865f9 The package contains code for automated files exfiltration. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-18218 Malicious code in qowa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67fe6a2b86c60720a8e3cc1002c183bd751ec1896d3be13a44b5ce7d1623afbd The package provides a C2 server and agent with pre-filed credentials, disguised as a generic utility. --- Category: MALICIOUS - The campaign has clearly...

MAL-2026-18216 Malicious code in @grabcad/preferences-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a82ed4dbc46827de73b0ea395df43cb2572eab547dc0decc3360973b848ac66e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18214 Malicious code in @grabcad/company-server-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d3297d13e6357ac5ba4aec72460852436e01486aeeffe04bf868aa8ccc58ceb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18217 Malicious code in @grabcad/user-license (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ee7b26cd209a020227ba0c1f36114bf1b1e7a533339f9e546e058dcc4af9909 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18215 Malicious code in @grabcad/grabcad-shop-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b255034a9e973919c82be7b2f75db934cc8a385c6cb388c6d632769b6ed0889 The package publishes under the @grabcad scope but provides no real functionality: index.js exports a Proxy stub that no-ops every property access, a...

MAL-2026-18212 Malicious code in @blueskydataplatform/shared-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a08838d93b2c88f441379d410a6d75804b0ae8836cd76db5d3cbb8548fd32d13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18213 Malicious code in @cecm-web-sdk/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95975e46912705ce591acef6b00c3b11b9dcf9f6ea8f1f89840a77a3ec6134d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18209 Malicious code in @ecg-internal/js-react-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 533583f613bf03556a1660b5bd8eaf4d5899c96dc79f4c42ae6b883aea8fde0e The package is published under an internal-looking scope @ecg-internal and ships a stub main module that returns a Proxy of no-op functions for every...

MAL-2026-18207 Malicious code in @ecg-internal/aurora-js-formatters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02325fb617beffd55194047faca7300b33934cd471de94bab66a24954200cba0 The package uses an internal-looking scope @ecg-internal and an implausibly high version 99.0.1 consistent with dependency-confusion targeting. On...

MAL-2026-18210 Malicious code in @ecg-internal/media-util-js-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c716438d9014063b4616588b1522ba2de2f3cf4fd961212840ed6a324cced3da The package publishes to the public npm registry under the scoped name @ecg-internal/media-util-js-lib, which resembles an internal namespace. It shi...

MAL-2026-18208 Malicious code in @ecg-internal/favourites-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0f37fd70766d2ddda31ffe3b985eba596fd927fdd589a9ceff04d4a695e3bb1 The package publishes under the internal-looking scope @ecg-internal/ and ships a postinstall script beacon.cjs plus a top-level require side effect ...

MAL-2026-18206 Malicious code in @ecg-internal/adobe-dmp-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a24a1672f5d2075c0159dee85aaad5dcb27d0cdc7eb6e007bfdbb742b82149f Package uses the @ecg-internal/ scope resembling an internal namespace and ships a minimal stub whose only effect is to beacon host identifiers to a...

MAL-2026-18211 Malicious code in @ecg-internal/reviews-dialog-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d077157e19fb33158004d020ab55ba68751851a9dbab6a010064a83b8436c4 The npm package @ecg-internal/[email protected] is a dependency-confusion payload targeting an internal @ecg-internal/ scope. package.json...

MAL-2026-18205 Malicious code in @tekmidian/pai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edec0655f6132f9a6bcf8c5025db3cbb86d2802ade88ab4f3acc6af4b3f40adb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18204 Malicious code in @factiii/runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c97d268b51a17426b7c3b70ff862f8020fe2551344e17e6187c4016cd2178781 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18203 Malicious code in journey-teste-shellhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b0297ac29ad3587325dc37510f2af62bef8b7d92f76e7f123739fc6f49cead0c In specific environments, package starts a reverse shell during installation. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-18200 Malicious code in @seggy116/next-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5c18734e8db92923153cc8bbf81fe90bcb53d5fe9d17a7640014d51e165dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18199 Malicious code in @pkgship/frps-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e58ce3b050fea33c534b17cada105c9c7eef3b0daf59a904a1b31151035a727 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18198 Malicious code in @pkgship/frpc-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99b326de85c188621a7204e38f8d68eea6969822d6012215c9f776fa70054568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18202 Malicious code in sdk-utils-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea4b599291b3a9c88aa74d76577283eca640df072aa340bf95558077c06527fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18201 Malicious code in kvarzo8f3atestmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a85ccef88aba99ac71165f2b02e40f009e9ac8d25319da2abe5a712a1886ac47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18194 Malicious code in @lumen-labs-dev/whisper-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2145d9e34cf3963885cc79e221d5c24c17333f9303e3ebd558bd7642c10c2ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18195 Malicious code in darknode-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f6c3e391187cc33e816213aed18babc900e7ec1a4152baaf7fdfb63a76319b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18197 Malicious code in x402-prompt-injection-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88f52d4070c48d6b724799575ba65b28cb4b2e218b4eda4a67fbbbe353add870 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18196 Malicious code in imgdecode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c49d68e668c31b846588dba958146553f2f144a6778073dfeeffd14af78faf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18190 Malicious code in @liauto/darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c28d1be2a555bd8dfb04c636fbc78a5add132fb5be0bfee0ff204a0d529f770 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...