240368 matches found
MAL-2026-18465 Malicious code in @bigdevin55/calculator-install-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4f509ad1b4b7cd4ab0ae5811238d85189643a2aae0157b75925ccd18f375e58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18466 Malicious code in @bigdevin55/calculator-install-hook (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47b31798da27fd690ed90f5702bbe7458e3363fa5488b9d2c77ddd8e17da6111 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18467 Malicious code in @nuxzofficial/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20a17042e445631051160d83e41511f46995e3b5323b625a2a52aa260d12ccbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18469 Malicious code in nuxzofficial (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0c5ef840e3b19a9367837e10bdad5698c89edd6a60e19f9cc0cefa5aa26fa04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18470 Malicious code in tailwindcss-animate-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bca3980db08806736fa490afdb7dc84c9fde44f0363c0be8b21d299fa4f92f38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18468 Malicious code in @utilitycraft/tailwindcss-motion-atelier (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c599649d975de035ad90c3e00aaa44e013bbac939a4c20e545b8c9669a7ea7ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18600 Malicious code in @ubedsockets/baileys (npm)
Malicious package. @ubedsockets/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. On connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...
MAL-2026-18464 Malicious code in atlassian-wallboard-plugin1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 807cc35cd4507bf2dae7c378dc81cdc04d0f49f47845907592ce92ed9633d2fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18463 Malicious code in persona-ai-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32b7c1491521ddee48ecbbb75d77f9dabad642430d8d253f6ef5a256eeae57bf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18462 Malicious code in intercom-react-native-example-e2e-tests (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f17f130fc5b4fa9192f15a6e914928336f4e591d424b5bec8696923519d2793f The OpenSSF Package Analysis project identified 'intercom-react-native-example-e2e-tests' @ 1.0.1 rubygems as malicious. It is considered...
MAL-2026-18461 Malicious code in shoaib-unity (RubyGems)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01fd98b807f4f85a6e016b143dec086ea16de731fb1de0cd84763dbf5d8f6919 The gem declares an extension script mkrfconf.rb that runs automatically during gem install. On execution, it collects installer host identifiers...
MAL-2026-18623 Malicious code in xenacious_kangaroo_blush-47 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18620 Malicious code in temporary_smelt_lavender-81 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18610 Malicious code in hushed_zebra_green-81 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18614 Malicious code in motionless_mandrill_blush-51 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18613 Malicious code in itchy_gecko_magenta-98 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18616 Malicious code in smooth_angelfish_emerald-54 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18606 Malicious code in colossal_wallaby_pink-87 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18612 Malicious code in intimate_ostrich_amethyst-45 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18607 Malicious code in et_phone_home (npm)
Runs on install. The postinstall script fetches a path from a bare IPv4 address with wget, contacting a remote host from every machine that installs the package. Version examined: 0.0.5; tarball SHA-256 58f9b4c9c26abe6ac52353ce1e0a824fba06c8aa7cefa94d2d4805306053e82c...
MAL-2026-18608 Malicious code in gugodapis (npm)
Dropper. At run time the package downloads a Windows batch file from a remote URL into the system temporary directory and executes it with childprocess.exec. The payload is fetched, not shipped, so the code that runs is controlled by the remote host. Version examined: 1.0.0; tarball SHA-256...
MAL-2026-18617 Malicious code in sound_deer_apricot-15 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18619 Malicious code in specific_sheep_violet-22 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18621 Malicious code in unfortunate_crawdad_emerald-79 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18618 Malicious code in southern_duck_tan-16 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18622 Malicious code in valid_antlion_amber-50 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18609 Malicious code in hollow_wildebeest_silver-94 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18605 Malicious code in babyyodaa (npm)
Runs on install. The preinstall script marks a shell script bundled in the package as executable and runs it; the script contains a reverse-shell pattern, giving a remote party a shell on the installing machine. Version examined: 1.1.0; tarball SHA-256...
MAL-2026-18604 Malicious code in @signals-notebook/annotation-editor (npm)
Runs on install. The preinstall script sends the output of id the installing user's identity and groups, base64-encoded, to a request-bin host with curl. This is the dependency-confusion probe pattern; it leaks data from every machine that installs the package. Version examined: 2.2.60-630109c;...
MAL-2026-18611 Malicious code in inadequate_earwig_magenta-66 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18615 Malicious code in pure_opossum_amaranth-54 (npm)
Part of a self-republishing campaign: generated names of the form -, each package shipping the same autopublish.js, which runs npm publish --access public to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies...
MAL-2026-18515 Malicious code in @goparrot-dashboard-api/store (npm)
@goparrot-dashboard-api/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Versi...
MAL-2026-18516 Malicious code in @goparrot-dashboard-api/users (npm)
@goparrot-dashboard-api/users is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Versi...
MAL-2026-18511 Malicious code in @goparrot-dashboard/store (npm)
@goparrot-dashboard/store is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...
MAL-2026-18504 Malicious code in @goparrot-dashboard/loyalty (npm)
@goparrot-dashboard/loyalty is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0...
MAL-2026-18507 Malicious code in @goparrot-dashboard/order (npm)
@goparrot-dashboard/order is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...
MAL-2026-18495 Malicious code in @goparrot-dashboard/category (npm)
@goparrot-dashboard/category is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...
MAL-2026-18496 Malicious code in @goparrot-dashboard/combo-group (npm)
@goparrot-dashboard/combo-group is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...
MAL-2026-18501 Malicious code in @goparrot-dashboard/franchise-menu-settings (npm)
@goparrot-dashboard/franchise-menu-settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same...
MAL-2026-18502 Malicious code in @goparrot-dashboard/homepages (npm)
@goparrot-dashboard/homepages is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...
MAL-2026-18505 Malicious code in @goparrot-dashboard/marketing (npm)
@goparrot-dashboard/marketing is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...
MAL-2026-18510 Malicious code in @goparrot-dashboard/settings (npm)
@goparrot-dashboard/settings is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...
MAL-2026-18494 Malicious code in @goparrot-dashboard/auth (npm)
@goparrot-dashboard/auth is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...
MAL-2026-18493 Malicious code in @goparrot-dashboard/analytics (npm)
@goparrot-dashboard/analytics is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...
MAL-2026-18499 Malicious code in @goparrot-dashboard/franchise-management (npm)
@goparrot-dashboard/franchise-management is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...
MAL-2026-18503 Malicious code in @goparrot-dashboard/i18n (npm)
@goparrot-dashboard/i18n is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0.1...
MAL-2026-18508 Malicious code in @goparrot-dashboard/payment (npm)
@goparrot-dashboard/payment is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version 0.0...
MAL-2026-18509 Malicious code in @goparrot-dashboard/promotion (npm)
@goparrot-dashboard/promotion is a dependency-confusion probe: it takes a name in a @goparrot-dashboard scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name. Version...
MAL-2026-18512 Malicious code in @goparrot-dashboard-api/orchestration (npm)
@goparrot-dashboard-api/orchestration is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same nam...
MAL-2026-18513 Malicious code in @goparrot-dashboard-api/role-v2 (npm)
@goparrot-dashboard-api/role-v2 is a dependency-confusion probe: it takes a name in a @goparrot-dashboard-api scope that its publisher created on npm, next to GoParrot's public @goparrot scope, so a build that resolves that scope from npm gets it instead of a private package of the same name...