239514 matches found
MAL-2026-17718 Malicious code in @brick-v2/table (npm)
@brick-v2/table is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...
MAL-2026-17723 Malicious code in @galicia-toolkit-nestjs/paas (npm)
@galicia-toolkit-nestjs/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim...
MAL-2026-17722 Malicious code in @galicia-toolkit-nestjs/commons (npm)
@galicia-toolkit-nestjs/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...
MAL-2026-17729 Malicious code in @galicia-toolkit-nestjs-20-lite/commons (npm)
@galicia-toolkit-nestjs-20-lite/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon...
MAL-2026-17724 Malicious code in @galicia-toolkit-nestjs/swagger (npm)
@galicia-toolkit-nestjs/swagger is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...
MAL-2026-17715 Malicious code in @brick-v2/core (npm)
@brick-v2/core is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...
MAL-2026-17726 Malicious code in @galicia-toolkit-nestjs-20/commons (npm)
@galicia-toolkit-nestjs-20/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...
MAL-2026-17721 Malicious code in @galicia-toolkit-nestjs/archetype (npm)
@galicia-toolkit-nestjs/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...
MAL-2026-17730 Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)
@galicia-toolkit-nestjs-20-lite/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...
MAL-2026-17716 Malicious code in @brick-v2/form (npm)
@brick-v2/form is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...
MAL-2026-17717 Malicious code in @brick-v2/icons (npm)
@brick-v2/icons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...
MAL-2026-17713 Malicious code in sharpnes (crates.io)
sharpnes is a malicious crate published to crates.io on 2026-10-09 by the account crows7781-glitch versions 0.1.0 and 0.1.1, described only as "The sharpnes project is a learn.". It is an infostealer that exfiltrates data to attacker-controlled Telegram bots when the exported async function...
MAL-2026-17709 Malicious code in revine (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dbf4288af8869a7f4875c4de38fa05874802fc4f0fda831170aa143bc1dbb9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17706 Malicious code in testrrrd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91a77cc9dbdff4799414082dc85fc6581b9f2d7297136dea8c50540f7d5244ad On npm install, package.json scripts.postinstall runs node beacon.cjs, which POSTs a JSON payload containing the installer's hostname os.hostname,...
MAL-2026-17704 Malicious code in @wxwxtest/testrrrdd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34 The package ships a postinstall script scripts.postinstall runs node beacon.cjs and a top-level require'./beacon.cjs'.fire in index.js that POST...
MAL-2026-17707 Malicious code in wie888r (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b [email protected] ships a stub main index.js that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name d...
MAL-2026-17708 Malicious code in xblaxw (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed [email protected] is a stub package whose only behavior is a beacon. The package.json postinstall script runs node beacon.cjs, which collects host...
MAL-2026-17705 Malicious code in css-overscroll-contain (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d978121f021eb6136e6a34db790556ba757de3bb8fa81981903445baf025d16 The package advertises itself as a CSS overscroll-behavior utility but its shipped modules thunderboltRegistry.js and sibling files named after...
MAL-2026-17702 Malicious code in kafka-helmsman (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...
MAL-2026-17703 Malicious code in kafka-roller (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4490e03c9b281c985d7cc5c877d359f8f3789a2ec44421602137c461ac4a2a52 The package is published to PyPI under the name kafka-roller with metadata impersonating Tesla's teslamotors/kafka-helmsman project homepage points a...
MAL-2026-17701 Malicious code in @kxafunc/xbails (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629c665fbfef767c56d24af935d38312f7aa88d1c71d9dfb8c427192e54add0b package.json aliases the libsignal dependency to npm:@bellaxchuu/libsignal-node@latest — a non-standard publisher pinned to the mutable latest dist-t...
MAL-2026-17694 Malicious code in @bitwardne/jslib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d Package @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form cu...
MAL-2026-17693 Malicious code in @bitwardne/cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7d0b3168a3a56cb6208688970e6109a964ccfb99a97fe7061d57e007b67ca6 package.json declares a preinstall lifecycle script of the form 'curl -L | node', which fetches remote content and executes it in Node at npm install...
MAL-2026-17692 Malicious code in clickfix_npm_delivery (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d The package has no library surface. package.json declares main: index.html and the tarball ships only that HTML page, whose sole purpose is a ClickFi...
MAL-2026-17688 Malicious code in @galicia-toolkit/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be976704e590db4fd796db1569b0835af0dfc8d829e21282116f210a4c741a59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17686 Malicious code in tailwindcss-effects-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12c9b58efdc05227da51bfb1031a80205144b4c6945b06eb9cbad7d416ab4873 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17687 Malicious code in tailwindcss-ui-extensions (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deb799e18fe77928819080979322bbcc868ba4373af021aec1efea4b201e4108 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17689 Malicious code in @galicia-toolkit/error-master (npm)
@galicia-toolkit/[email protected] claims the @galicia-toolkit scope and describes itself as a dependency-confusion PoC. Its postinstall hook runs on npm install using node postinstall.js || true and sends encoded hostname, working-directory, platform, runtime-version, and username data as DNS...
MAL-2026-17691 Malicious code in @galicia-toolkit/tag-manager (npm)
@galicia-toolkit/tag-manager claims the @galicia-toolkit scope and describes itself as a dependency-confusion PoC. Its postinstall hook runs node postinstall.js || true on npm install; the script collects host, platform, runtime, network, and environment data, then sends it over HTTP to...
MAL-2026-17690 Malicious code in @galicia-toolkit/spa-build-config (npm)
@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...
MAL-2026-17685 Malicious code in system-driver (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5e4a0cbbe434f312002efedefa09d6d1ad79d13300812d7b43e1302fd6e562 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17683 Malicious code in node-fetch-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17682 Malicious code in connector-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d9f20c94a9242e8d3ee6ef52fd22dfb8e57a8c08ae3ff52776b7ba3234f1702 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17684 Malicious code in node-gyp-runtime (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcec19492c8bdcd8c866d1aad1a2b8a253d7d9bbc8184ff182af71a75ce56589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17681 Malicious code in node-env-resolve (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...
MAL-2026-17344 Malicious code in @bellaxchuu/familyxtrx (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17677 Malicious code in @bellaxchuu/overbugs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4bf34e6d2aa5b187e4dba9c90ce9515cd1fdc5a43f37195ba21e9cb418eb19c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17678 Malicious code in @bellaxchuu/xbailey (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d07ffaff1ea6694d0579feba4090d61917939563b17e9395b875bb0c2aaf0b01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17350 Malicious code in @bellaxchuu/xtrxbails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17345 Malicious code in @bellaxchuu/flowblue (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17349 Malicious code in @bellaxchuu/velvetry (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17346 Malicious code in @bellaxchuu/privatebails (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17676 Malicious code in @bellaxchuu/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f70788aeca5b98fbe0c721d7f6a88c036d661c3f0132443a6bdb97080f5819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17347 Malicious code in @bellaxchuu/skyblue (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17679 Malicious code in @bellaxchuu/xbails (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f73138335788b7e9bb6c1df9db9ae6f82fa260c75d703ddfb850cba883c7d076 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17680 Malicious code in @bellaxchuu/yarnbails (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f991cf1a14df0cd0bbec0bd9340f983ea34dc98070e0e1c810e22653aecf469 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17675 Malicious code in @bellaxchuu/bails (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6ca3e47d499dc50a641bc4c0d6c01228aa55dfcf76a4c8504680ce1dc1196e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17384 Malicious code in @xayz/baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...
MAL-2026-17671 Malicious code in @xayz/brat-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02a3da7453991350934623a3bb78f98f83a1ce952be9d320c4461c779e472bd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17400 Malicious code in my-baileys (npm)
This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...