⚡ Weekly Recap: Hot CVEs, npm Worm Returns, Firefox RCE, M365 Email Raid & More

Hackers aren't kicking down the door anymore. They just use the same tools we use every day — code packages, cloud accounts, email, chat, phones, and "trusted" partners — and turn them against us. One bad download can leak your keys. One weak vendor can expose many customers at once. One guest...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Malicious code in @lokeswari-satyanarayanan/rn-zustand-expo-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73fe3bd99e2f11ab8bb09a9086c4dca8af56372031492ed11d90f1e32a0e8f53 The package @lokeswari-satyanarayanan/rn-zustand-expo-template was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4db5527f8a6098b9553e656b50ee1e0fcae45b163917de83299e9e5200ff96f The package @voiceflow/eslint-config was found to contain malicious code. Source: ghsa-malware...

Malicious code in @oku-ui/motion-nuxt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f92b87caa59206174882fe75cd77964bc3f31b824958a07a22210e50eeb21ac9 The package @oku-ui/motion-nuxt was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a8c6b88ad67d8ceece37df9641f6712f7047aa566957d0937eb3ca99aed10dd The package @voiceflow/runtime was found to contain malicious code. Source: ghsa-malware...

Malicious code in @vucod/email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91b5731b235151065b43287967fa368625822413bb181076f044b34a155d0c5 The package @vucod/email was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/vitest-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75f61861d4cf96b95713be7af95e0e0480df49eb37236e6e59c838c165584781 The package @voiceflow/vitest-config was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/presence (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ccfe3cd227dfd52c2a7bb6d2c15fc511a5d1baab2eb3378960905005e421b9a The package @oku-ui/presence was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db3392082319ffd4259935cf7d4eae448c38fdea2e5d9a1749c26a991fd78dc1 The package @voiceflow/metrics was found to contain malicious code. Source: ghsa-malware...

Malicious code in @silgi/scalar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 718db30ae906e5148f4892029a4e6e20c813dfa5ef8eb9a76a46b1c1769445d3 The package @silgi/scalar was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56b737a01a45b68e312a6864869538663927b97e9662c9e4e885d24a464fff51 The package @oku-ui/separator was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191264 Malicious code in @oku-ui/portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0711033d654f75b42d8959721555bcf5aa5fb766ccc12b6e89c56eef0d8cafd The package @oku-ui/portal was found to contain malicious code. Source: google-open-source-security...

Malicious code in @posthog/bitbucket-release-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cd4323384e4b29aac2ac56b7eea22bbaafb8579a013ff55f7d7b26f0c972a0a The package @posthog/bitbucket-release-tracker was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 085e9cbdb891d5b550a81a42584b1cdd8ab001a9443b162158aa633ce18b1e06 The package @oku-ui/arrow was found to contain malicious code. Source: google-open-source-security...

Malicious code in ceviz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1dfb19a9ba10272dfd3ead68f0cbe940fbaef80738a39e53d44201c3aadc250 The package ceviz was found to contain malicious code. Source: ghsa-malware b6b575b73c5d275b6b6a0f81a03aade8f1e27eabc47214b4a77f300f014b6219 Any...

Malicious code in @productdevbook/animejs-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c2acfd4cc90c6efaba5b4ac9fffbeb99c09185946aa16771401d7227d137c24 The package @productdevbook/animejs-vue was found to contain malicious code. Source: google-open-source-security...