Malicious code in @asyncapi/modelina-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3144264289038cf791432dc902acf2aafe218ea12a11fd986f2690b63531157 The package @asyncapi/modelina-cli was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b13eec1644f2d38922b7e61732a64ae6ee0d71810232ff15c95a3290de465d The package @asyncapi/cli was found to contain malicious code. Source: ghsa-malware 99e5bdb2a7d429f7e01403c432963826b244c3bed02a5a877ace1307b5fee3ad...

Malicious code in @asyncapi/diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afa55a72fa4b01b54926fbef60ac9ac0ece6a9128ddbdd3d883aa6ee7bb8c67c The package @asyncapi/diff was found to contain malicious code. Source: ghsa-malware dfe913f8a298c7c2e8e2e4708025a868cba9d567779195881f90ba52bdc8d14c...

Malicious code in @alaan/s2s-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e50bdec2a61138175bbd86f2b001903eb76400352b9bef5e55afcd6610fbbafa The package @alaan/s2s-auth was found to contain malicious code. Source: ghsa-malware f48811a0a401773ab205d7ce2a4ce4d1890a0ed23b75a75cd45e5140c702c99...

Malicious code in crypto-addr-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 900adb7a0d7713cca5ccdc793971f3489553656e4e132b80293ad56c55d05b2a The package crypto-addr-codec was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/content-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39aeb9f2a2d9a8ee1c57695456c8af6657d069eaee694ef7f8c128bb292bfabd The package @ensdomains/content-hash was found to contain malicious code. Source: ghsa-malware...

Malicious code in zapier-platform-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6a8e70a62a44d7da3a1f1caeeb67241d97ac421579751019149dbdce044bf6a The package zapier-platform-schema was found to contain malicious code. Source: ghsa-malware...

Malicious code in @zapier/secret-scrubber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c109e973086267fe5b99a110c559267a26254a0bb87dcffbaf3fb69ea4bbca75 The package @zapier/secret-scrubber was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/multi-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fca41600409d9446c4771677d000e0c23cb7f5a5d876cff66c762472d477bae The package @asyncapi/multi-parser was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190661 Malicious code in @asyncapi/multi-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fca41600409d9446c4771677d000e0c23cb7f5a5d876cff66c762472d477bae The package @asyncapi/multi-parser was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190654 Malicious code in @asyncapi/converter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391d5e53843731fb634a2f3811928f21e466b64aa48d1383b08f7f3708f603db The package @asyncapi/converter was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190637 Malicious code in @asyncapi/generator-react-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0dadd48783af136a9dcf3f65cf9f24675841f02c7d1a5b6dc60709b392bf98 The package @asyncapi/generator-react-sdk was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/generator-react-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0dadd48783af136a9dcf3f65cf9f24675841f02c7d1a5b6dc60709b392bf98 The package @asyncapi/generator-react-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190644 Malicious code in @posthog/ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a9a022b20b3025cb0846139ab6f2a1308025ed8ee902db18aacbfa95c6ea7e6 The package @posthog/ai was found to contain malicious code. Source: ghsa-malware 1e6a08419969270cca059f804bb3ec25aa0427f00ef555a9409c12d50921a83c An...

MAL-2025-190642 Malicious code in @asyncapi/react-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9ebe88915a6eee986912a6566783764ff832588763eaa7b763710ed9f992299 The package @asyncapi/react-component was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190639 Malicious code in @asyncapi/openapi-schema-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b4e9b39029c1f0084db9cd77fb419e5b003036f5b3db50d6b52097114f0c729 The package @asyncapi/openapi-schema-parser was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190643 Malicious code in @asyncapi/specs (npm)

@asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2 were published as part of the "Miasma RAT" software supply-chain attack campaign identifier "miasma-train-p1" that compromised several widely used @asyncapi npm packages on 2026-07-14. Unlike the whitespace-hiding technique used in the compromise...

MAL-2025-190645 Malicious code in @posthog/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92317c7f15a5eade85fe5c248b9b31870be1b384a5e5455dd3ea546c94c279e4 The package @posthog/core was found to contain malicious code. Source: ghsa-malware 8fce4f3a908b835a108ad8c30d1f2095f67e065911b353c73d0f9151be9ed6bf...

MAL-2025-190648 Malicious code in @zapier/zapier-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d39a04949d436340c422fef75a4dab8c20b487218e69e62cdcd198bddbe9ee0e The package @zapier/zapier-sdk was found to contain malicious code. Source: ghsa-malware...

CVE-2025-12739

CVE-2025-12739 involves a Cross-Site Scripting (XSS) vulnerability in Looker’s Extension Loader. An attacker with viewer permissions can craft a malicious URL that, when opened by a Looker administrator, could run attacker-supplied script. Exploitation requires at least one Looker extension insta...