MAL-2026-11673 Malicious code in @or-sdk/authorizer (npm)

npm/@or-sdk/authorizer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

MAL-2025-105736 Malicious code in mean_toad-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d299adb49899e3abaaea346e6fe1d9ec313f2c264a05ed3611d617d3149a7829 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sticky-tax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f92c80c437f457550f2dfb4bf9e163b735bcf6388b77765abb913ac9905e94cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...