`finch_cli_rust` was removed from crates.io for malicious code

This attempts to typosquat the existing crate finchcli to steal credentials from local files. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 18 times. There were no crates depending on this crate on crates.io. Thanks to Matthias Zepper of NGI Sweden for reportin...

Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems

Shai-hulud 2.0 campaign features a sophisticated variant capable of stealing credentials and secrets from major cloud platforms and developer services, while automating the backdooring of NPM packages maintained by victims. Its advanced tactics enable rapid, stealthy propagation across the softwa...

Malicious code in eslint-config-kinvey-flex-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2a9878339c2f4bb9dd2871f516aa58a93438018366470f0a023f02178420971 The package eslint-config-kinvey-flex-service was found to contain malicious code. Source: ghsa-malware...

Malicious code in @oku-ui/popper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c757bdb980fe7035718ca706928b603973b5cc84bc5d18fbe3ab776cbd44e149 The package @oku-ui/popper was found to contain malicious code. Source: google-open-source-security...

Malicious code in create-silgi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1bd1ddfab5f3ea6caf4f09a93f2ef08f7298e2d68892949e0a6f2975cd1b78 The package create-silgi was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/roving-focus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9c5700b2618856ae03ff24523ae655b9b1014a11d02768b8904387d07da4fc The package @oku-ui/roving-focus was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191332 Malicious code in @voiceflow/anthropic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5894ea8ba7ea0e9636e873dae07eb97fdcf83510f4e7a28b23f1d0b2e0a0afe0 The package @voiceflow/anthropic was found to contain malicious code. Source: google-open-source-security...

Malicious code in quickswap-ads-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a51e9188f2b9786cc34efba72bae1dbcf1b659db890a4b5d133a8b94ea60c13 The package quickswap-ads-list was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/base-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f955f868f3684364e34509e8ac923e40a6b84bf081690378886f6a64d77721 The package @voiceflow/base-types was found to contain malicious code. Source: ghsa-malware...

Malicious code in @posthog/zendesk-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ee22feb7805e50708b86abe78fb463cafe5f1a3408f41297a18deafa6e110fb The package @posthog/zendesk-plugin was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191300 Malicious code in @posthog/zendesk-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ee22feb7805e50708b86abe78fb463cafe5f1a3408f41297a18deafa6e110fb The package @posthog/zendesk-plugin was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191274 Malicious code in @oku-ui/slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71cb82e7b11eea9aa7260ed7a7e31a29e21d10d81735768c536e42ee88d28b71 The package @oku-ui/slider was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191284 Malicious code in @pergel/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d52bf0972dc9dad856bf4bc427d7d1bc127b3b0db55ec37a6e1d5327ffe59237 The package @pergel/cli was found to contain malicious code. Source: google-open-source-security...

Malicious code in @livecms/nuxt-live-edit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9233c57c8a4b8ad058160ae369f3b94efba6bf89774e63f3bd4355e106009871 The package @livecms/nuxt-live-edit was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/react-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7450440b7c3368ef719fcfa9511d7984fc38ed8b5279f4e49f414f588446915e The package @voiceflow/react-chat was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/git-branch-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374d8cf65cd8bf44935889995a1fe36af800d8f570be40b594fa1b3bca1c184d The package @voiceflow/git-branch-check was found to contain malicious code. Source: ghsa-malware...

Malicious code in @oku-ui/toggle-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb7f999444c4458fefe9d248fe0eaf410814ecbb5343107fe992033a61d184f3 The package @oku-ui/toggle-group was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/scroll-area (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feec27c9dd0a9e2e311e7acfd63e100ca5a09fe90c7e8aeb9237e7722ea49a77 The package @oku-ui/scroll-area was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/chat-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 427a4ea537f2410d7af761667dfaa0440a0ddbf74e1a963230491a8d6155e4fd The package @voiceflow/chat-types was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/prettier-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d559f73440d8fdf3f6f155244ce54b5d8d829700d5780778a26f0ac94fb5b59e The package @voiceflow/prettier-config was found to contain malicious code. Source: ghsa-malware...