MAL-2025-192301 Malicious code in elf-stats-mulled-ornament-810 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a68193ecbc69141a7ed610f69110b64551adf4ac175894416841205703c9db3 The package elf-stats-mulled-ornament-810 was found to contain malicious code. Source: ghsa-malware...

Malicious code in @oku-ui/primitives (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48684386017546a6d1cc3afd6317d995fe7edc730db2789b79af9135d8f88191 The package @oku-ui/primitives was found to contain malicious code. Source: ghsa-malware...

Malicious code in victoriaxoaquyet-wallet-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c392a47bef024ed55b8fa5f13c1629cc9565b281683139ffd90449d4868386 The package victoriaxoaquyet-wallet-core was found to contain malicious code. Source: ghsa-malware...

Malicious code in @posthog/plugin-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbacde545c940abfe63a0667580ea37cfc021d6b3e25094b71e23273cd899e1b The package @posthog/plugin-server was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-jam-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 369fe7c56e5f271a31e023cbe36323fc11043fc4747d0309c5c48aaa1eedf822 The package react-jam-icons was found to contain malicious code. Source: ghsa-malware 1c50426946a6dd92cf360d347aa3ed8f15988f3655c7721aff8dd0b8ff8e946...

Malicious code in hover-design-prototype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db96c13324b014e92e639e93401c356c60bdd7d020bc22c5327900ccbab0220a The package hover-design-prototype was found to contain malicious code. Source: ghsa-malware...

Malicious code in compare-obj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1892ab55a1dcdd44c7f030aef1ae76a865ffffe4b7a0d4a0492696c149db2e4d The package compare-obj was found to contain malicious code. Source: ghsa-malware 3a7310cc13d858af4c2dfc25ec5d42cf6aa52b00dd7fc28ba0ee069a68e7551b An...

Malicious code in open2internet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe1cf5da09eaf98a63e880a56f10409eaec90f40d9d3a7938b4bea09aeada36 The package open2internet was found to contain malicious code. Source: ghsa-malware 7df2207057942014062d4c686449d02043f6f221e63ee8014453f995f1429200...

Malicious code in medusa-plugin-zalopay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c2a2c7cda991bd113cf7b4cd391451e22bc26d4df3fa7a96669ad4c7d1c219 The package medusa-plugin-zalopay was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/keeper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b1620523a3ce8e3a6d91cc4b532723797a0cc56a36e303774caf14ef1acffd The package @asyncapi/keeper was found to contain malicious code. Source: ghsa-malware b4de90c140688e48a7bd263f6ce83227887405e7322154faa001d6bdf787cd...

Malicious code in @asyncapi/server-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 228ed250759da1a81a55ea29e65821a583726c0c472d925b0c86d4e44e49e002 The package @asyncapi/server-api was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/curvearithmetics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e8d0412a2e09e5e875c436da127697b8fe370cc878272dc55216b4d6b16d13c The package @ensdomains/curvearithmetics was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/ccip-read-worker-viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57b104a492d5893772494de67a98f0114e695a8d24e0444d12d0963029fc4b32 The package @ensdomains/ccip-read-worker-viem was found to contain malicious code. Source: ghsa-malware...

Malicious code in @trigo/atrix-orientdb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dff5fee3398c42159c86cf250a0b25cae13f5e94b812aa6ef984b8fa8b4bd543 The package @trigo/atrix-orientdb was found to contain malicious code. Source: ghsa-malware...

Malicious code in @trigo/keycloak-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87c444dc1ce66be4f196ec79b9db852b3c8c3bcf029738b61e4471c034c96fe0 The package @trigo/keycloak-api was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/generator (npm)

@asyncapi/generator version 3.3.1 was published as part of the "Miasma RAT" software supply-chain attack campaign identifier "miasma-train-p1" that compromised several widely used @asyncapi npm packages on 2026-07-14. The malicious code was injected using whitespace hiding: it is appended to a...

MAL-2025-190632 Malicious code in tailwind-pulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 994e15b9c34fb68a81553df4c2a51b9412bbcc3543da29a73b6f087507c9ea4c The package tailwind-pulse was found to contain malicious code. Source: ghsa-malware ca854515da8a9c174658ca39afad56810ab87adcaa9eff2fca5043dbd8f50d04...

Malicious code in @aio-commerce-sdk/config-vitest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 952a468e9821b0b8238bc9a6e6c0f9ee4964fca63e82403ed880279141fb5088 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48590 Malicious code in baidu-tims (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8df1a41ee221825ba6e320bbed60cefc43c2254a86e89ff493988c7b5ee8ad3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48426 Malicious code in vite-plugin-parseflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6264d2fd8e60e842a2b4b3e0d5b8da287d27e021ff47460da70171fb82adf3b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...