Affected: npm: itsa-react-maskedinput

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (6914d695ead470d8344308ee1f4fe9600932b7afbfcd14550ea2e95f8d54a6f6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have bee…

Affected: npm: itsa-react-focuscontainer

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (3f24dbbde4e8dd3528a7be768f6d332bda8a3dbdebbb82054ad14992ab4b5889) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have …

Affected: npm: @beloved-lenora/opencode-shell-guard

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (122dea54602061507a3752f709f1e910d9126fdaf9fb282aeab13caca388b3e6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the compute…

Affected: npm: @beloved-lenora/opencode-shared-rpc

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (884dad30e4b92d47985e1d8e7db8580665e8a5cd392023ea672243b62685b157) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer…

Affected: npm: @beloved-lenora/opencode-todo

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (3b77fc053f72d1eaff51ad3b9af235119b5aa1dbb28d216c084e7023d4e963f6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may h…

Affected: npm: @beloved-lenora/opencode-stats

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (84f3316cd114c1dae8ec5b0470fc9f16297c74c495b645085103a553002e825e) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may …

Affected: npm: @beloved-lenora/opencode-goal

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (39f1eed75bb488db0e57e37f9f513e30a616eb00464b41c33bdea3342b9969b6) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may h…

Affected: npm: @beloved-lenora/opencode-btw

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (d95b5328fe2ba73358ca014724b677f69e5b9f8dda1429c105fde5c823dc2fc1) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may ha…

Affected: npm: @beloved-lenora/opencode-orchestrator

--- _-= Per source details. Do not edit below this line.=-_

## Source: ghsa-malware (fb9b82fbe28422745ef37e0239d9a11d86705c6a93808e1e90303e31622db2fe) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the comput…

Affected: PyPI: pyyi

The verified PyPI wheel declares a console command named python2 (pyyi.cli:main). For commands other than the local REPL, help, version, unlock, or uninstall paths, it obtains configuration and calls run_payload(). Registration sends the hostname and OS to a configured space-z.ai server and stores the returned apiKey in ~/.python2/config.json. The REPL presents a normal Python banner but silently sends eligible single-token inputs to /api/cli/unloc…