MAL-2026-18753 Malicious code in gcp-log-poc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c During import, package exfiltrates information about the environment, including potentially sensitive environment variables. --- Category: MALICIOUS - The...

MAL-2026-18752 Malicious code in qzc690384 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aaf64364e0f3a5688772d501b9400cd9caf65ecdc82a869844ff73999aff2e4 The adjudication model's output was cut off by the provider safety filter on every attempt, which happens when the reviewed code reads like operation...

MAL-2026-18750 Malicious code in qzc690383 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06 On pip install, setup.py executes shell commands to collect installer host identifiers id, whoami, hostname, uname, nvidia-smi output, /proc/1/cmdlin...

MAL-2026-18749 Malicious code in qzc690382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e The package body is inert init.py contains only c\n; the entire functionality lives in setup.py, which runs on pip install. During install, setup.py...

MAL-2026-18751 Malicious code in qzc690385 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 769e3917f43083b27dfab168a49801cf5d70393de27f359bc406ff2260f23edb At install time, setup.py polls the local Xinference API at http://127.0.0.1:9997/v1/modelregistrations/flexible, selects model registrations whose...

MAL-2026-18747 Malicious code in genblaze-atlascloud (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18746 Malicious code in genblaze-fal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 253796cb8693d039c09267f3d6d398031e3ad27640bb70f21f2e75d2578be649 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18748 Malicious code in dsh-notify-focus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c91c538bb4d09c5ad66bc46daa4a39dbc36c87c314f92a9faf5738a3e3581ffe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18745 Malicious code in pulumi-doppler (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50b46d564c0937fb09c4343eb0c9a8eb2d33b8b4eca8b85b5419ebd686100e06 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18737 Malicious code in @cherrydotfun/miniapp-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f67d291f8d7fbfc32f2fa1e88ea8e02074821d6f7ac1675a32a15d87e51be139 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18742 Malicious code in fhqiouhq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 50625c43075a763e4420504dcbcc8b14236874f2924ec20eabcf5d7b45b0a274 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-18741 Malicious code in ajfhiuqhfqgwerhuqnfqh (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1da9c2dae077cc96d13ab9964ca2887742f0dc1bc2a3e92f4b0bf9b6d0e3b04 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-18744 Malicious code in reqnests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 285a91689676a0169502a364e60033283150056487ad681648ab60cb4fe6d23e During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-18743 Malicious code in reqnest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 819e0998a4223acf5f70c15fbbeea8f9c9bf801044d5974622ebc2a971bc2c61 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-18740 Malicious code in tailwind-animationfound (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5725a79f072138dd41b4b01a7b85f4db141a064f8b9b0d1f9b2f58de46b38b57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18739 Malicious code in modelsdesk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 245d6cf605a8824c3c98e826cbba55c70291bb6d26c1639c306a7a0cf565ed75 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18738 Malicious code in kampodine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42480f59964b6128cd6e0d2fdb239ac695aa0ac534f7d4577ea56331cb105715 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18736 Malicious code in automic-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7cd96d34518e6d009a6d720791d1bcdccb28c127f0abe189cdf21823feb64e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18735 Malicious code in hello-bat-fwi9 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b The package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the...

MAL-2026-18733 Malicious code in monopw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b9eea2030fc78f02622fac87418eb061c00f88e7f06bde0cad322331f24ea428 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18732 Malicious code in monobomber (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb048ce530214799000fdcb8886e4731fac2c5d63cf673c431384001fbcfa2f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18734 Malicious code in tw-motion-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6126defd99b4d1f60df367804e1700624cdb6e02d2447160c98a901839b7b475 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18730 Malicious code in wisdomtreetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e4630a25894ac32585fce0321742859b4abeb85e165ec7c1f1db0948678c668 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18725 Malicious code in @ts-expect-error/n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb1181753b662057b42470341334eb06f4dd5e66ad121abf172ed8cd812dfa7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18724 Malicious code in @site-cms/ssr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84e138f3690a5d6e147d0f73db95583647a9cf3ed0c7f8beba73d89bc28f5bb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18722 Malicious code in @noinheritdoc/n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d6fb3554c37166a7d69d4bf5f672bcc2f0461d763c685b99b4af654e0e0c874 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18723 Malicious code in @sideeffects/n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5c4de6df1f4a8ce4bbbf205ce1e053b684ba72c4bfe1c36b9d6f8f40b01fd7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18721 Malicious code in @needsaudit/nexport (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3075c04420ad628321590fb8d6c90add7dd1e2940afa1c40ec2a1e87569800c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18720 Malicious code in @needsaudit/n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6597c3fd2a454df33edf83d187ebdc7efb1764c8319c3ae0ea57abcc6ee8938e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17442 Malicious code in @smart-dev-wa/baileys (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-18731 Malicious code in zero2-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba57fc7bb4bcf036443073304ad388fbd23b2cfff4aeebfca8fcf50baf1ee0a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18728 Malicious code in kc-kline-chart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 248c91825aeab2e07e381ad4d4816abcb644771c1d3aac0239dd99045d7f5f7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18727 Malicious code in evmos-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f419cb119fd933884054bde2a713b965f67ffc5d7b81bafe10f4d6dfeb91d9ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18726 Malicious code in arc-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b435bceea3dca010177d87d412866993c2dd5c9e99ab31994eab56b202f1e93 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18729 Malicious code in securedrop-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f10f1f6b11db2b6dd5c7d36e77cf8d83dba43ae2f4dddb06ce752beaaae5bc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18719 Malicious code in @kora20030101/test-pkg-delete-me (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 819b1b3a509b0b9622da5c8a176f8cc3642d5e8f76bdacbc3dda7b2f9f50af2a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18717 Malicious code in @exclipz/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 642e5dee2e46ea01f45d16689f6037de36956b35e5c4c390d88c8638fd415a4e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18718 Malicious code in @exclipz/bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8abb39c9776d322abb7f9f8fd03c769020bbdd84a7ff6e3a23248bee2cdf09e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18715 Malicious code in talk-lang (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8e589e06b10e1f613a0f257df979e7caa57034a7aa4c651550b9578aac971bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18714 Malicious code in plain-lang (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df1ba24c92506ceefa77e3a013fd4126bc4855ccd4dbfe919ca34a241968e1e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18709 Malicious code in test1817 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f578c35f0e7c6126af4b55ff7c0ba2b1ea02eff7cefce6cffd571daeba0015a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18708 Malicious code in @gemshell/win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 995d5bbf551f5d90619b3d9c6bb2d822165ae47cece8c07c0f7de919cd7200e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18707 Malicious code in dsh-purge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71e83de88c6bf3ad0b5fa0afdaa7bc4b85e5084206afa3e7b99e90c9f9ee1050 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18716 Malicious code in @nuri.yavuz.tr.2/my-unique-pinger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d9a584d7d9890fd25a656e38f323071b7ac3b419a2050fe50452c598f78a4876 The OpenSSF Package Analysis project identified '@nuri.yavuz.tr.2/my-unique-pinger' @ 1.0.2 npm as malicious. It is considered malicious because...

MAL-2026-18706 Malicious code in mcp-teamviewer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 54d27496a09fce8a393650469621dc308a6578c6cf694589bda9d4b298a6c08e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18705 Malicious code in teamviewer-mcp-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fbb7b3161ae2b934700783590dc4c48728b86ef818fd212a87e3deb9c490b42c The OpenSSF Package Analysis project identified 'teamviewer-mcp-server' @ 0.0.1 pypi as malicious. It is considered malicious because: - The...

MAL-2026-18704 Malicious code in dbt-adapter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 baabd8e63cd4f6ad9e5a4ff9c2575b965d85030868aa31cc485902475b26465e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18703 Malicious code in synapse-hub (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f57819a01fb45a9343ab157eb1e4a607933844bd68c9c22425ceac38a995fd2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18658 Malicious code in rcp-ndcg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5aa5f39fdbcfd160716eebb87c6bb303d9d6e08eb1beacee5a9a90f228fe7fff Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-18657 Malicious code in strands-aidr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5f7d32ed4f94170c5bd90f8123b2b328eb13b13fad22690cce67dde42281cb23 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...