MAL-2025-190985 Malicious code in pdf-annotation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30a9825714dd4a01b7deb1226158bce68ad4456f16230aed225cb7240d7c4344 The package pdf-annotation was found to contain malicious code. Source: ghsa-malware 955e80d981658c3ea77d6ae52df04c36931e4d9403d1a44976b8222b2aa9c4f4...

MAL-2025-190949 Malicious code in colors-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84ccf2bd5bd452f49978832d66685075c10f116c9cc007d7d8c31a2e001b3efe The package colors-regex was found to contain malicious code. Source: ghsa-malware 79632b803684fda175b5701ef644e5ef4e7791334d60bf8e8635cdb0f0d01164 A...

MAL-2025-190909 Malicious code in @postman/postman-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7c276129c0d99cb4f8aa63e9f3911b1f38145837396ac3b00ba48533a6050b8 The package @postman/postman-mcp-server was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190905 Malicious code in @postman/pm-bin-macos-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7af6b141ac3ae548c7fadfe1523b270a35c69e8f5c20035f682e9ee726f1bdec The package @postman/pm-bin-macos-x64 was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190913 Malicious code in @postman/wdio-junit-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ac6f5998a89d257823fdf6368153d30126e695eb96b8ba6a5cd500fe661b8f8 The package @postman/wdio-junit-reporter was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190874 Malicious code in @posthog/currency-normalization-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9c408cabd7de49cf79956eda3f74bde72c000069ac4d356f6a410f02cfa155f The package @posthog/currency-normalization-plugin was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190904 Malicious code in @postman/pm-bin-macos-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9784306ff54e49967977f9fc58b5d335de3a19434cc7d7d277ee8097ef3079d The package @postman/pm-bin-macos-arm64 was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190900 Malicious code in @posthog/wizard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43ed05e891884ed2cf2d6f1790352cd3d07f97a03c6fb152561eb2e8b9d938c2 The package @posthog/wizard was found to contain malicious code. Source: google-open-source-security...

MAL-2025-190841 Malicious code in evm-checkcode-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67c49d35b6096e7c647d830c11a75a90f1bd3b90677f1c72d1bdefcd87b134e8 The package evm-checkcode-cli was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190806 Malicious code in @ensdomains/mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa69028234e7d9845b0190a845d7ed004315332e53db9625716d3e8c34f9d555 The package @ensdomains/mock was found to contain malicious code. Source: ghsa-malware e5e3d7ebf0c01ec0fcf11c5473aa2d0ae19924590bc4f27ac7e988945272d5...

MAL-2025-190788 Malicious code in zapier-async-storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03106802713a8738ac15728a0fdb19774a74ac3ae3aa76b501b8d4b08e8a7e5e The package zapier-async-storage was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190744 Malicious code in @kvytech/medusa-plugin-announcement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fda18824e7544b009117ab962028a53a03245d741b85fa30789a9cda67f5b1b The package @kvytech/medusa-plugin-announcement was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190702 Malicious code in trigo-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b342d6dbb3287df2002c455ce23553f3aa118b46e447741fa840397425741076 The package trigo-react-app was found to contain malicious code. Source: ghsa-malware 11f63c9b322a04a69d7c2c875302dfe971081157a6ea2c3360e65c5e4f9f5a9...

MAL-2025-190638 Malicious code in @asyncapi/modelina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6021816ea47fd6743ed24c196df8db60f0649e0d5b185ceb9b418ba457b21e3 The package @asyncapi/modelina was found to contain malicious code. Source: ghsa-malware...

Malicious code in yakutsk-alphard-winston-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42520c8dc3cb5fcd945016e4d3fca6d736c2b65f9e37c7c765d7c18be63ba45d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-husky-tachyon-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47d6d40bbd46796ffe0433b9e3e0fd88b76fb46ceb7a4973ff526bea29bf1b9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in glaciology-wormhole-cz-conventional-changelog-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a8e1427315241f9ca0e6b823c4472689c97f4ce67871133412359ec0964a80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-writable-webpack-cosmogenic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d97564ab9fc4db43f4230b9d93ccc412d62ff1b73b25e6ee7eeca8c3f4298df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phenomic-paleoclimatology-slidev-websockets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 279c8e17a716179e47c018d674da33af1505e188e89645680d467ba11d2917a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blazar-quark-publish-quito (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6051df5e76609f10fbecf1f58e20ad09d8098ec4fed4723d9a81bca13555b27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...