MAL-2025-191203 Malicious code in @clausehq/flows-step-mqtt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55586de02f72931159b200d06ceacff4a40d50ee20e753335fffab62df93608c The package @clausehq/flows-step-mqtt was found to contain malicious code. Source: ghsa-malware...

Malicious code in @clausehq/flows-step-mqtt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55586de02f72931159b200d06ceacff4a40d50ee20e753335fffab62df93608c The package @clausehq/flows-step-mqtt was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191202 Malicious code in @clausehq/flows-step-jsontoxml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55490991efb020a37958f1460276c1439d022da66dd47d2799e4e676c1d898a2 The package @clausehq/flows-step-jsontoxml was found to contain malicious code. Source: ghsa-malware...

Malicious code in @clausehq/flows-step-jsontoxml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55490991efb020a37958f1460276c1439d022da66dd47d2799e4e676c1d898a2 The package @clausehq/flows-step-jsontoxml was found to contain malicious code. Source: ghsa-malware...

Malicious code in @clausehq/flows-step-httprequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126cc191c92f3dd4eb7a0c64301c3d7e0ff5d999596b4c1b3584e38f130495cc The package @clausehq/flows-step-httprequest was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191201 Malicious code in @clausehq/flows-step-httprequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126cc191c92f3dd4eb7a0c64301c3d7e0ff5d999596b4c1b3584e38f130495cc The package @clausehq/flows-step-httprequest was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191200 Malicious code in @chtijs/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d13d42ca03eebf6bafc9addea00583d377c625dfac5eaff226bc3b0a155788c8 The package @chtijs/eslint-config was found to contain malicious code. Source: ghsa-malware...

Malicious code in @chtijs/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d13d42ca03eebf6bafc9addea00583d377c625dfac5eaff226bc3b0a155788c8 The package @chtijs/eslint-config was found to contain malicious code. Source: ghsa-malware...

02-echo contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

Security Bulletin: NVIDIA NeMo Agent Toolkit - November 2025

NVIDIA has released a software update for NVIDIA® NeMo Agent Toolkit. To protect your system, clone or update this software to version 1.3.0 or later from NVIDIA GitHub. The affected sub-module is https://github.com/NVIDIA/NeMo-Agent-Toolkit-UI. Go to NVIDIA Product Security. To protect your...

Security Bulletin: NVIDIA NeMo Framework - November 2025

NVIDIA has released a software update for NVIDIA® NeMo Framework. To protect your system, clone or update this software to version 2.5.1 or later from NVIDIA/NeMo Framework on NVIDIA GitHub and pypi. Go to NVIDIA Product Security...

@actbase/react-kakaosdk contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/markdown-it-cicero contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-absolute contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

Malicious code in @micado-digital/stadtmarketing-kufstein-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b458f23284c11d0533df6f7d474554467329282fb52e761f0a654ef8cf69f3e The package @micado-digital/stadtmarketing-kufstein-external was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191246 Malicious code in @micado-digital/stadtmarketing-kufstein-external (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b458f23284c11d0533df6f7d474554467329282fb52e761f0a654ef8cf69f3e The package @micado-digital/stadtmarketing-kufstein-external was found to contain malicious code. Source: ghsa-malware...

Malicious code in quickswap-v2-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4313e2b3fbb458efed74babcd2a8ec50374c189c7e41f82e4e8c2121350a962e The package quickswap-v2-sdk was found to contain malicious code. Source: ghsa-malware 3166b60c9fe686ac7370d58396dbbfa253204d33049707ea4799b075e6d00b...

MAL-2025-191244 Malicious code in @lui-ui/lui-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8515f668c012cc4072d376364ab0ed194d6040b86dbc19737c43a7ab00acd2d4 The package @lui-ui/lui-tailwindcss was found to contain malicious code. Source: ghsa-malware...

Malicious code in @lui-ui/lui-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8515f668c012cc4072d376364ab0ed194d6040b86dbc19737c43a7ab00acd2d4 The package @lui-ui/lui-tailwindcss was found to contain malicious code. Source: ghsa-malware...

Malicious code in quickswap-smart-order-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65a1978f5a844fe2a4875f031a7498db4411fdf687fe752f1dbbcea7a6a31fba The package quickswap-smart-order-router was found to contain malicious code. Source: ghsa-malware...