MAL-2026-10960 Malicious code in markscan (npm)

The markscan package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that...

Malicious code in markscan (npm)

The markscan package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that...

Malicious code in aftermath-sui (npm)

The aftermath-sui package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

MAL-2026-10933 Malicious code in twilio-deploy (npm)

The twilio-deploy package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

MAL-2026-10952 Malicious code in @markscan/core (npm)

The @markscan/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...

MAL-2026-10941 Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

MAL-2026-10959 Malicious code in iphouse-core (npm)

The iphouse-core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10947 Malicious code in @akrai/report (npm)

The @akrai/report package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10962 Malicious code in markscan-core (npm)

The markscan-core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10964 Malicious code in markscan-utils (npm)

The markscan-utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...

MAL-2026-10954 Malicious code in @markscan/utils (npm)

The @markscan/utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms ...

MAL-2026-10949 Malicious code in @iphouse/api (npm)

The @iphouse/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10958 Malicious code in iphouse-api (npm)

The iphouse-api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in twilio-platform-async-data-fetch (npm)

The twilio-platform-async-data-fetch package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

Malicious code in twilio-assets (npm)

The twilio-assets package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against a...

Malicious code in iphouse (npm)

The iphouse package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that ...

MAL-2026-10948 Malicious code in @akrai/report_new (npm)

The @akrai/reportnew package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...

MAL-2026-10956 Malicious code in akrai-report-new (npm)

The akrai-report-new package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...