MAL-2026-15430 Malicious code in secure-test-browser-t7a9jtay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2e171ed7ab636742175ee4a3eb1043bcea89d15d080a05130a138bde7c265fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15436 Malicious code in secure-test-browser-ui1d892v (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44bcf3be56af9ecd21fab7aae6b84be4ce66de8fc32609b1f4bb924ba39163ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15376 Malicious code in secure-test-browser-khflxpz7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c12ae1b7adce18b5bf1e85eea712c4990f54cbd877f9eb533e02d6447aa2b1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15402 Malicious code in secure-test-browser-o5kevayg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2a9e2e27881860fdab8cc5c467bb74a795d7e40f005214e580eedfacbb36a0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15351 Malicious code in secure-test-browser-ggbh6tng (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd4edd79ce6ac910c2bd864624e532a72b39bf24106a2ea33dca8657f0e1ec6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15085 Malicious code in classlink-hl9uycka (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 533d18d1ba7ba0106f598ec2df54d5ced49fd3317e7e28223f98fd4d38f1600f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15397 Malicious code in secure-test-browser-nu4lhvyb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83f713c1c8e7ffd4859243fb775549c3b227287dab73e98928d74896e9b076a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15320 Malicious code in secure-test-browser-c5iac3qm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fa7356a903ebb6b6b821ec69557a0c88d08150498ef799f09da9f5f959e9613 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15448 Malicious code in secure-test-browser-wrbb4ntb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96a8dd86574941ec82e5b672934f23fcf3a5264516d64df5033b6ef2e688e190 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15321 Malicious code in secure-test-browser-c9b32eoo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2561afdbe4e3567e18a8c8b8ed59ecec6a071356d78e16efe06b9231d8c459e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15415 Malicious code in secure-test-browser-qq9c659k (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 490d3cd5ee3bfaa6f825b60636c5c301efa1fe297d1b1be2bb1d2f4adefdce99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15456 Malicious code in secure-test-browser-y4yd7ndu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f792c1beb7268d7c12da9151f5f9596965848efd31f960cf9e5d9025a97fd8a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15340 Malicious code in secure-test-browser-f0dzh835 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8117f018fbe2ce8c046c1d11130385bf498ff67562c6165cf1f678367f9783e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15019 Malicious code in classlink-3k14cslj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c73066e7a49843f780bc6d7556adf24fe0e12bad370921e4c3a9f6ee8a821e8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15428 Malicious code in secure-test-browser-srukyz7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ff47fa214bf98e8821ef7d0069ae81998d13f4635195dbb227facde184dcd49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15468 Malicious code in secure-test-browser-zbkz03dn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 932249a153280d54bc9b00e44e25cc37f98bf90428b9ab6954882db3163141cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15455 Malicious code in secure-test-browser-xynt39lg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a734e3f6caa0722bcb17cfd44319516cc5cbc36c0581c4600e9c694bece70ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15465 Malicious code in secure-test-browser-z6d4ruii (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11a9076c20cb4bddfc1ad8237c6fc02e7ed3400076921662f8812f4d4c4f8849 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15266 Malicious code in secure-test-browser-1yjarnvk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7995072543002e808e597ccfd49ae3d1497ac3073f3afddee765664f8cfc446b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15416 Malicious code in secure-test-browser-r270knja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3c235aa5b2d461c2f9ddef4695c30e516ebc61b94161361ce3f9871fc1ae1ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15339 Malicious code in secure-test-browser-ezbajpcd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f72332762c242f4b79ccf79c0d87caf5578be04c48f34e87641979c5bc8521d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14591 Malicious code in cacao1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 403a43aab3b982d17c5c01d7df45149d796e7185f4137bf4a92675351a1b50e8 The package has no advertised functionality empty description, self-referential dependency on its own name at ^9.9.9. Its package.json declares both...

MAL-2026-14589 Malicious code in yamlformat-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 60b8ab6c62beb2bbbe4e2926cf9cda17f060f9c4184d33ed57d363d9a771b734 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-14590 Malicious code in yamlformatter-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ef2cbf7d7c360d11860ea9383a1ed84b491e75361f994359fd97284a5d25cdc2 During import, the package collects sensitive information and exfiltrates it using DNS queries. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-14587 Malicious code in pygame-renderkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdef1a055b3059d56581d5c0d33538e7799cfde5e42d596eb50094d06d984f54 setup.py registers a custom install command that forks a daemonized child during pip install and executes a base64-encoded Python payload via...

MAL-2026-14588 Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

MAL-2026-14586 Malicious code in @fleetbo/svro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d86373813cd4d2b65edb11f6a3f352ad81a55e7de0444884f66b0adb482e661 The package ships two heavily obfuscated JavaScript files under dist/ — postinstall.cjs and cli.cjs — using hex-mangled identifiers 0x56260b, 0x12d64...

MAL-2026-14585 Malicious code in @znan/wabot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e857d5e68584a6a0b5bde34073d45d16540ddda6d38bf7b3082e49d07bd8b484 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14578 Malicious code in pushgitquickx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557f230f5bf78b909b207a6568053a346e32a2fcbd14130a824bd6de8fc7fbf6 The push subcommand of this CLI catches exceptions from git operations and, in the error handler, sends the git error text and JSON-serialized git...

MAL-2026-14575 Malicious code in @hd-team/app-impkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1337f5939f8a1aab2f4e110aa41afd3b9f6cfe4501319a0ad33de48abf178cc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14576 Malicious code in @hd-team/app-impkg-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e4a6c7bf61aa8ff219249cee5204bc5fe556e216c34afa39a5ce2685399ffbb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14569 Malicious code in @hd-team/app-dnpkg-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f5be2650e129e66738602f02b893ba443ffbd9a47df685f76bd4ae84b885529 The tarball contains only package.json and index.js. index.js is not JavaScript source: it is a base64-encoded JSON blob that decodes to a...

MAL-2026-14571 Malicious code in @hd-team/app-dnpkg-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8d3c5fba8b00e8f8ebe7868093ff8cbe2b14607b15abad8a711310868d0833e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14574 Malicious code in @hd-team/app-dnpkg-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a881d064bac4343f3b849e3b2e45fa0bb9fb8249f191f85297f53edecf08d96b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14572 Malicious code in @hd-team/app-dnpkg-ten (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39fc060cffde63f6797eaa1eb715dbfec4a108f1c8d4b54d6ed6b63072bd9d80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14573 Malicious code in @hd-team/app-dnpkg-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30c16d5b694328dc82c0f6456769dae351790990437b7411f9e3a868ebf48dac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14570 Malicious code in @hd-team/app-dnpkg-eight (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36ebbb10d70e38e5772506ebd2604502a39d4c462730a4a1f2c4f21147959af9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14584 Malicious code in flyteplugins-redis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14583 Malicious code in flyteplugins-nsight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14581 Malicious code in flyteplugins-agento11y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14582 Malicious code in flyteplugins-echo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14577 Malicious code in hydration-ui-dlx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e76afa004355ba53a89056c6daff511bb4f41e2bd666e2a5592d033e079e5740 The package's main module contains a top-level IIFE that chmods 0o755 and detached-spawns dist/internal/math-calc.mjs, which is a Linux x8664 ELF...

MAL-2026-14579 Malicious code in svelte-ui-dlx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3de011fe8fbe406c62d909048d60d2619dbf85d8f8ec05079c8104d966e52a63 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14567 Malicious code in tailwindcss-3d-animate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc554005eb9004f33d22597b929261d865d4bfe991d0b99d148dc25fffb7e97c index.js re-exports the legitimate tailwindcss-3d plugin and then appends evalatob"..." at module top level, so the payload runs on any...

MAL-2026-14568 Malicious code in tailwindcss-form-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bf4e5fbd59048a5ab6a5c04ad7c98e7246c9cf57363d95acc84f92d8ca883f4 src/index.js re-exports the legitimate tailwindcss-forms plugin as a working cover, then appends an obfuscator.io-style 0x string-array cipher that...

MAL-2026-14565 Malicious code in stackpaths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a27ce2899b65f55deaab5feaf1b3cfd2ae674a45fd3e87ab442c58d3d89ba79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14560 Malicious code in inspectstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17cc87250d7ea2211f538d56ca04d81a6653e6493beb475ea371873ddfe6a65e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14557 Malicious code in charclass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8706b70b3238d5f94848a858e119e3e41d7102032d82a00ff3ae25915311d4e6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14558 Malicious code in deepjoin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7191d8ad9de3616fcf3be682d6755dc092dd05df7bf8c273d1ad867a0edd6d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14561 Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...