240368 matches found
MAL-2026-18315 Malicious code in dsh-native (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c9c9d92d65945abec57f269176d5080795ae9d832ab6f95525756cd508951bb The package's index.js contains occurrences of the token 'ping' across several lines 19, 526, 656, 690, 980, which triggered a pattern rule for...
MAL-2026-18311 Malicious code in bow-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f616a5be7835fbfd40088761cce2863d5ab04d1230e6b22a3e6dcd3fe2fc49b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17878 Malicious code in util-foriepft (npm)
[email protected] was published to npm on 2026-10-08 17:34 UTC by user regex33-hackerone. It is described as utility helpers but ships no library code: index.js is an empty module. thunderboltRegistry.js runs when the package is loaded, executes host commands through childprocess and sends thei...
MAL-2026-18314 Malicious code in css-hnhxwd-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fd2df1dd4f68e1495d31e75e18917e99ee002c60d5e0327d5d84f9e01d52e8b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18312 Malicious code in css-flexgap-shim (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f54735b551cfa311e09f18668c3b10360105519f2277b27d782036d3224c5b19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18313 Malicious code in css-grid-snap-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b283b75dfc6a5bc055d778b3c5855b75f1f80e95639420cabeb24f8440ec42 [email protected] ships a stub index.js that returns a static object and declares no install lifecycle hooks. The tarball additionally include...
MAL-2026-18310 Malicious code in @regex33-hackerone/tb-compat (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfbbff5e8cb2f0f8b14d300fed9343e48339c9c4e52579af53f926ced1218922 Package @regex33-hackerone/[email protected] contains two files with no detected malicious behavior. No install-time lifecycle scripts fetching remote...
MAL-2026-18320 Malicious code in @walknpm/todo-cli (npm)
@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with...
MAL-2026-18321 Malicious code in dsh-plugin-blender-3d (npm)
[email protected] is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to...
MAL-2026-18305 Malicious code in @s4yhiitestpoc/r2-https-dualuse (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06d8987a5408de1fd879005877185e31a5a0931162318ade2fc1a4e6ce6592c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18306 Malicious code in @s4yhiitestpoc/scan-control-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d0a8c4d5ab871942d5301ffe7797ba35882108ed4f9195f5000f7e274455827 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18307 Malicious code in @s4yhiitestpoc/scan-dns-c (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb3c4b0863ee69937b926b58ee5255e26d0ab3737abd640b92956aef1ca03fb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18302 Malicious code in @s4yhiitestpoc/r2-control (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2818910f030224e598ac988354614e0febeaed195238b06fcefb80d1932dc965 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18304 Malicious code in @s4yhiitestpoc/r2-echo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95d0e909637faadf9360929eb9b01bfac02f0a4bdf7bff852267657d09c5b459 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18308 Malicious code in @s4yhiitestpoc/scan-echo-b (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56326de32baad0d0d893359e14cf73b56e8139d714f3106fde0c24fdb4004091 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18303 Malicious code in @s4yhiitestpoc/r2-dns (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0c56aeb91a20a757ea94500434819d64c0ab2a067c00ccf7dc325e23abdb46a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18309 Malicious code in @s4yhiitestpoc/scan-https-dualuse-e (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc69b9998deea152d8088db89469ab4f8fa468d68e8cb923b25c7e91f8facf04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-18301 Malicious code in dictmerge-lite (PyPI)
dictmerge-lite 1.0.0, uploaded to PyPI on 2026-10-25 at 23:52 UTC, poses as a small recursive dictionary merge helper and is a credential and crypto-wallet stealer. Importing the package runs the payload: dictmergelite/init.py imports telemetry and starts telemetry.runasync, a non-daemon thread s...
MAL-2026-18632 Malicious code in canta-baileys (npm)
canta-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query and then MUTE, so the channel go...
MAL-2026-18693 Malicious code in ruby-baileys (npm)
ruby-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in src/Socket/index.js sends the WhatsApp w:mex FOLLOW query for channel invite codes...
MAL-2026-18694 Malicious code in solidity-cat (npm)
solidity-cat ships index.js, which is byte-identical to the hardhat-hold payload: an obfuscator.io-style loader built on execSync and axios that fetches and runs a second stage. It is a new name for the hardhat-hold MAL-2026-14246 campaign; the file hashes below match that record's evidence. The...
MAL-2026-18683 Malicious code in @zaxius/baileys (npm)
@zaxius/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs , using th...
MAL-2026-18691 Malicious code in ndraawzz-baileys (npm)
ndraawzz-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18682 Malicious code in @wanzforme/bails (npm)
@wanzforme/bails is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18685 Malicious code in aemeath-baileys (npm)
aemeath-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js, lib/autofollow-newsletters.js sends the WhatsApp w:mex FOLLOW query...
MAL-2026-18697 Malicious code in testtestkjkldfnjdfn (npm)
testtestkjkldfnjdfn ships nebula.js, byte-identical to the nebulajs-api payload, and a preinstall.cjs that is a single opaque Function... call decoding XOR-encrypted code at install time. It is a new name for the nebulajs-api MAL-2026-17220 campaign; the file hashes below match that record's...
MAL-2026-18700 Malicious code in wisewwasd (npm)
wisewwasd is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to t...
MAL-2026-18701 Malicious code in wxwxtt (npm)
wxwxtt is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to the...
MAL-2026-18331 Malicious code in birch-css-utils (npm)
birch-css-utils ships index.mjs, byte-identical to the noelc-css-blender payload, and an obfuscated build-cache.mjs that reassembles and execs encoded chunks. It is a new name for the noelc-css-blender MAL-2026-18249 campaign; the file hashes below match that record's evidence. The package presen...
MAL-2026-18673 Malicious code in @bellaxchan/sixtech (npm)
@bellaxchan/sixtech is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18675 Malicious code in @denzz221/baileys (npm)
@denzz221/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18671 Malicious code in @bellaxchan/bailtech (npm)
@bellaxchan/bailtech is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18677 Malicious code in @k.vict1999/pino-std-serializers (npm)
@k.vict1999/pino-std-serializers ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The package presents...
MAL-2026-18692 Malicious code in pino-std (npm)
pino-std ships lib/contract.js, byte-identical to the pino-testkit payload: a copy of the pino logger with an extra obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The...
MAL-2026-18684 Malicious code in @zyrennofficiall/baileys (npm)
@zyrennofficiall/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. A timer started when the socket connects, in lib/Socket/newsletter.js, sends the WhatsApp w:mex FOLLOW query for the...
MAL-2026-18687 Malicious code in ichigokurosaki-baileys (npm)
ichigokurosaki-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18688 Malicious code in kevinx-baileys (npm)
kevinx-baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18669 Malicious code in @alannxds/baileys (npm)
@alannxds/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18672 Malicious code in @bellaxchan/eleventech (npm)
@bellaxchan/eleventech is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18676 Malicious code in @dyllxnn/baileys (npm)
@dyllxnn/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18681 Malicious code in @sakataa/baileys (npm)
@sakataa/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18698 Malicious code in wiasdcxc (npm)
wiasdcxc is a dependency-confusion package versions up to 99.0.1 from the same campaign as troubleshooting MAL-2026-17641: a postinstall script runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector, and index.js, byte-identical to th...
MAL-2026-18695 Malicious code in solidity-gas-watcher (npm)
solidity-gas-watcher ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below matc...
MAL-2026-18696 Malicious code in solidity-map (npm)
solidity-map ships index.js and lib/config.js, byte-identical to the hardhat-roof and chai-foundry payloads: a pino copy whose entry point loads an obfuscated dropper. It is a new name for the hardhat-roof MAL-2026-17509 and chai-foundry MAL-2026-13356 campaign; the file hashes below match that...
MAL-2026-18702 Malicious code in xzvbailss (npm)
xzvbailss is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18686 Malicious code in cs-core-api-phoenix (npm)
cs-core-api-phoenix 5.1.0 is a dependency-confusion package: its postinstall script reads the OS user name and hostname and POSTs them to https://nathanaccacio.com/collect on every install. It targets an internal-looking name and collects data from whoever installs it, without consent...
MAL-2026-18689 Malicious code in loader-utils-kit (npm)
loader-utils-kit ships lib/contract.js, byte-identical to the pino-testkit payload: an obfuscated module that decodes and evaluates code at load. It is a new name for the pino-testkit MAL-2026-16484 campaign; the file hashes below match that record's evidence. The package presents itself as an...
MAL-2026-18674 Malicious code in @bellaxchan/techxatz (npm)
@bellaxchan/techxatz is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs store...
MAL-2026-18679 Malicious code in @monze1239/baileys (npm)
@monze1239/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...
MAL-2026-18680 Malicious code in @raffnotdev/baileys (npm)
@raffnotdev/baileys is a fork of the Baileys WhatsApp Web library that silently subscribes the installer's own WhatsApp account to WhatsApp Channels chosen by the publisher. When the socket connects, code in lib/Socket/newsletter.js sends the WhatsApp w:mex FOLLOW query for the channel IDs...