Malicious code in @asyncapi/php-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81619d0ddfa1696b71c550ba94be4ddbdaed53aaef37376f8024945422da51b5 The package @asyncapi/php-template was found to contain malicious code. Source: ghsa-malware...

Malicious code in @actbase/node-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0017bb31e0f352229b8a7afc7305701c64b60033a69ccfec390385c507c6d85 The package @actbase/node-server was found to contain malicious code. Source: ghsa-malware...

Malicious code in @trigo/jsdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff5aae2e5762514a4d2a304a2ceb36d9b895c8bd88c9a6303752aea4b078119f The package @trigo/jsdt was found to contain malicious code. Source: ghsa-malware 91f1b0ba55c42b887eade435580838bef529a7fe7a9b9fd8b3cd05ada0528cc7 An...

Malicious code in @asyncapi/specs (npm)

@asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2 were published as part of the "Miasma RAT" software supply-chain attack campaign identifier "miasma-train-p1" that compromised several widely used @asyncapi npm packages on 2026-07-14. Unlike the whitespace-hiding technique used in the compromise...

MAL-2025-190555 Malicious code in tailwindcss-webfont-awesome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37cc31540e459bb02a97d3d2ce96eecdcff72b1c3e07f0e875540b68ba48a60 The package tailwindcss-webfont-awesome was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190512 Malicious code in bcryptkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a480449fe3e91f066e60e8f4ed7d4c85e6915b3c9b2712769c54eac67eefa452 The package bcryptkit was found to contain malicious code. Source: ghsa-malware fabc375d7ac31af2156e2d4ecf33d4e87df80d7b95873af883a10d9c35dfabb9 Any...

MAL-2025-66552 Malicious code in vite-plugin-postcss-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4552bafe10098b91c4ce3128c885efb1c472d7f7c18b7bca5d2b174ed097e396 The package vite-plugin-postcss-tools was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-router-dom.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a54a5d0a9e2cbf3435d04524f79602d94e2a8b49ce9bf676ef37f23e44f1c28c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-49021 Malicious code in minify-dead-code-elimination (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae32f7c04b27629bde0236a0f5931b70208313af390161f1d6564c0022d9f39c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48784 Malicious code in vite-plugin-parsify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 031b7573beae98422d50771f010df5ea83910b304700e644b2e5b8cb6111aa59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-alerts-template-basic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea74fdb0b572b194c03927e7ed2eb81658a849eb093b395f77d6b74db3b1d7ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48564 Malicious code in deviceconnect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6c1a3984e1cb71a8f8426b3963787a49a096ce770bcabde9e63ca51fa5007e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48333 Malicious code in mad-1.2.5.2.2.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2a7a2c9ba3ee455fb1327bbf9794e2ff26b21cee0dd6d1feef0cb6b3d57da55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mad-1.0.0.2.2.8. (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a3660341162df2e49bb5407e0ca9b3bd7df2ef2e7aaf9c8cd43ac899b45d29b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in redirect-nq70u6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 099d83c25e6a8662b90ff95da62e95d6118eb1d71b1ed785e186f69054ae7f66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in com.unity.2d.spriteshape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5338704c6d9ca480f0ecc214b07912ff6b325612a7335034d750a40bdaf5c4b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47548 Malicious code in @sev-ui-verse/workflow-context (npm)

The package @sev-ui-verse/workflow-context was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b34fd25464abdc87cdcff95770eff1bf8f142ad5407a6487236fcc5c76f72f14 Any computer that has this package installed or running should be...

MAL-2025-47569 Malicious code in truelayer-service (npm)

The package truelayer-service was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc9900a38cc6f7543f01f0f226e5ac0ddf01b51bdc46b2e5da6caaf06ecc3155 Any computer that has this package installed or running should be considered fully...

MAL-2025-47553 Malicious code in envs-loader (npm)

The package envs-loader was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94802ccdee601e77ff6361593b03ef5b414dec7eaeccd58d8ed6b2305886b27d Any computer that has this package installed or running should be considered fully...

MAL-2025-47251 Malicious code in @openzeppelin-compact/fungible-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6a498e2883ed809f6b7d0b0fdd09f303aaf958af5a94634d835e001fdc4db78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...