MAL-2026-3180

    Dashboard / Malicious Package / MAL-2026-3180

    MAL-2026-3180

    Published: 29 Apr 2026Last Modified: 30 Apr 2026

    Summary: Malicious code in nicegui (npm)

    Details: Malicious npm package published by threat actor "ryanmccollum1" typosquatting the popular Python NiceGUI framework. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git history, exfiltrating over a raw TCP socket to an AWS-hosted C2. Published by threat actor "ryanmccollum1" as part of the same campaign as redeem-onchain-sdk. Source: amazon-inspector (bdc02f08ae75f2010d8b5df4b7b4f083b25f30e8d4c8b8aee4c5c1f988e416ed) The package nicegui was found to contain malicious code.

    References: https://safedep.io/redeem-onchain-sdk-polymarket-npm-malware/

    Affected packages

    Package

    Name: nicegui

    Purl: pkg:npm/nicegui

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    0.1.4
    MAL-2026-3180 | CVE-DB