Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

MAL-2025-190858 Malicious code in rollup-plugin-httpfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bf613b52797ec3ff23536082d58a6d97dc4c672dfeecf2dc2ce21709ff8cdf7 The package rollup-plugin-httpfile was found to contain malicious code. Source: ghsa-malware...

Malicious code in rollup-plugin-httpfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bf613b52797ec3ff23536082d58a6d97dc4c672dfeecf2dc2ce21709ff8cdf7 The package rollup-plugin-httpfile was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198818

Malicious code in rollup-plugin-httpfile npm...

EUVD-2025-180049

Malicious code in biosignature-rollup-polaris-boson npm...

EUVD-2025-176599

Malicious code in rollup-plugin-start-galaxy-neutronstar npm...

Malicious code in heka-markdownlint-rollup-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3918091bf1dccaa7a82585cf98bba21f487de7dad3e092c4d5f4c7b1b3c7e9ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176602

Malicious code in rollup-plugin-loglevel-archaeoastronomy-on npm...

EUVD-2025-178500

Malicious code in hugo-build-configstore-rollup-plugin npm...

EUVD-2025-176869

Malicious code in quantum-rollup-plugin-neuromorphic-janus npm...

EUVD-2025-180046

Malicious code in biotechnology-apollo-rollup-plugin-nodemon npm...

EUVD-2025-176608

Malicious code in rollup-nova-wavefunction-rimraf npm...

EUVD-2025-176917

Malicious code in publish-superagent-rollup-plugin-commitlint npm...

EUVD-2025-176600

Malicious code in rollup-plugin-optimize-css-assets-webpack-plugin-bootes-polaris npm...

EUVD-2025-176500

Malicious code in schema-terser-prompts-rollup npm...

EUVD-2025-178697

Malicious code in global-rollup-plugin-lightyear-thermochronology npm...

Malicious code in archaeometry-rollup-plugin-astro-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dcfdaa9a4222852d826a3e0212b6a3584a79729124a8ff9ee1178222bb3de18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177368

Malicious code in paleoclimatology-nova-rollup-vortex npm...

EUVD-2025-176606

Malicious code in rollup-plugin-chai-soap-terser-webpack-plugin npm...

Malicious code in tool-pino-xenos-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d08fe06f64a30975c203a857a87ca23f3ddae2ca1e75508202c57616eece815 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...