Malicious code in @redhat-cloud-services/types (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

Malicious code in turbo-json-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a239b53ed6cbc1e72aac660afa08204b9de36dae39068c30cf175ddd390b4fd1 The package turbo-json-parser was found to contain malicious code. Source: ghsa-malware...

MAL-2026-77 Malicious code in polymarket-clob (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650fcd9e5cec151122c4e59ee9f829a9f8f3afbc998be35354879cd24f5d8bf The package polymarket-clob was found to contain malicious code. Source: ghsa-malware c6f2692198b832546ebc0a47e287ea8e976cbbacae0f1963545cb4610ddd08b...

Malicious code in redirect-v74zee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00eb82dc8fa348e42a4e1260cd210adb1e29238ba2b0d7035b5e9257cb2038b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in otc-echo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b0e38efe6cfc6243284d736f8569dc30c9f94b10388d60d4f0f323fbb84cf5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in req-bans (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 891a9d8d6df58ad3743a6ec2db7217d78ec1fe0a3d8bb938181ec4ac26ee5489 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in developerhome (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7433bdf0bc0ef30b65cb1a932f37643a50af404c09e94ff2c999308c68c3a7af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...