Embedded Malicious Code

Overview @asyncapi/modelina is a The Model SDK for generating data models Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package...

Malware in @asyncapi/modelina-cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-198635

Malicious code in @asyncapi/modelina npm...

MAL-2025-190638 Malicious code in @asyncapi/modelina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6021816ea47fd6743ed24c196df8db60f0649e0d5b185ceb9b418ba457b21e3 The package @asyncapi/modelina was found to contain malicious code. Source: ghsa-malware...

Malware in @asyncapi/modelina

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @asyncapi/modelina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6021816ea47fd6743ed24c196df8db60f0649e0d5b185ceb9b418ba457b21e3 The package @asyncapi/modelina was found to contain malicious code. Source: ghsa-malware...

@asyncapi/cli (>=0.21.0, <=0.27.3), @asyncapi/dotnet-nats-template (>=0.2.0, <=0.8.4) +9 more potentially affected by CVE-2023-23619 via @asyncapi/modelina (>=0.8.2, <=0.59.9)

@asyncapi/modelina NPM version =0.8.2, =0.21.0, =0.2.0, =0.1.8, =0.3.33, =0.4.0-rc.0, =0.0.1, =0.0.1, =0.1.0, =0.1.7 Source cves: CVE-2023-23619 Source advisory: MEND:CVE-2023-23619...

GHSA-4JG2-84C2-PJ95 Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina

Impact Anyone who is using the default presets and/or does not handle the functionality themself. Patches It is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not...