Affected: npm: tailwindcss-animatecss-keyframes

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (00e39ad48b12b71189406b236fcf40c114277c19b66aefd2a130e9bc6a0cee18) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer ma…

Affected: npm: @ikyyjee/ikyysingle

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated Wh…

Affected: npm: @ikyyjee/ikyysinggle

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated W…

Affected: npm: @ikyyjee/ikkysingle

This package is part of a large family (100+ identified as of September 2026) of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter JIDs, using the installer's own authenticated Wh…

Affected: npm: spf-analytics

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (8dece44c5ce884af66714dbff1f022e0345e860d0090cb7bcb30fd7b352cdd77) index.js is a heavily obfuscated browser script (obfuscator.io-style string-array + rotation) advertised for inclusion via unpkg on Shopify-style storefronts. At runtime it listens for the 'gokwik_events' window event and harvests customer name, phone, email, full address, …

Affected: npm: vectorizers

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (d1082db2b4593a2b60921a85d2f4c760a294a67b1a48007959d75d61f670dc87) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to …

Affected: npm: random-certs

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (e002d7cdc913cbca420ce86f079af16abcbe8dcf80da03cac0cb5127fb4f8dcc) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to…

Affected: npm: waie-crash-baileys

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (bfd798457d1d852c2699245eff20fad82b3ced47bda89498772b630a369c2f58) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been gi…

Affected: npm: with-cte

with-cte@1.0.0 contains no functional code: its only behaviour is a preinstall script that runs `node index.js` on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends them as JSON in an HTTPS POST to `187d714jo62z5j5c39hc437myd44sxgm.oastify.com`, a Burp Collaborator endpoint. The npm account testneo7755 published …

Affected: npm: checkmate-remediation-assistant

checkmate-remediation-assistant@1.0.0 contains no functional code: its only behaviour is a preinstall script that runs `node index.js` on npm install. index.js collects the install directory, the user's home directory, hostname, username and DNS servers, and the full contents of /etc/passwd and /etc/hosts, then sends them as JSON in an HTTPS POST to `9q0lp9mr6ek7nrnklhzkmbpuglmda4yt.oastify.com`, a Burp Collaborator en…