2629 matches found
MAL-2025-190671 Malicious code in @posthog/cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57662af8290901771cf534d8b1ca05ca88dfd84054580144d934f730549a4653 The package @posthog/cli was found to contain malicious code. Source: ghsa-malware e663c40b9060088ff86ea24eec083b9b5bf8afdec2e1963895e47e5177a673d1 A...
MAL-2025-190649 Malicious code in posthog-react-native-session-replay (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2487b6f3e3f9f2ef47f2509033fe071b332f5035e1e01320482eea928ae8a120 The package posthog-react-native-session-replay was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190637 Malicious code in @asyncapi/generator-react-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0dadd48783af136a9dcf3f65cf9f24675841f02c7d1a5b6dc60709b392bf98 The package @asyncapi/generator-react-sdk was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190638 Malicious code in @asyncapi/modelina (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6021816ea47fd6743ed24c196df8db60f0649e0d5b185ceb9b418ba457b21e3 The package @asyncapi/modelina was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190644 Malicious code in @posthog/ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a9a022b20b3025cb0846139ab6f2a1308025ed8ee902db18aacbfa95c6ea7e6 The package @posthog/ai was found to contain malicious code. Source: ghsa-malware 1e6a08419969270cca059f804bb3ec25aa0427f00ef555a9409c12d50921a83c An...
MAL-2025-190639 Malicious code in @asyncapi/openapi-schema-parser (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b4e9b39029c1f0084db9cd77fb419e5b003036f5b3db50d6b52097114f0c729 The package @asyncapi/openapi-schema-parser was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190647 Malicious code in @postman/tunnel-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6961dafcc910bb7a6b1db8cb597068eeb85f973dcd669392354a7b614928dbf5 The package @postman/tunnel-agent was found to contain malicious code. Source: ghsa-malware...
MAL-2025-190643 Malicious code in @asyncapi/specs (npm)
@asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2 were published as part of the "Miasma RAT" software supply-chain attack campaign identifier "miasma-train-p1" that compromised several widely used @asyncapi npm packages on 2026-07-14. Unlike the whitespace-hiding technique used in the compromise...
MAL-2025-190645 Malicious code in @posthog/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92317c7f15a5eade85fe5c248b9b31870be1b384a5e5455dd3ea546c94c279e4 The package @posthog/core was found to contain malicious code. Source: ghsa-malware 8fce4f3a908b835a108ad8c30d1f2095f67e065911b353c73d0f9151be9ed6bf...
MAL-2025-190782 Malicious code in shinhan-limit-scrap (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dae6aee79d5386d3525290fdc37160052ab2cfc88cfe444751cf1e0c09122b48 The package shinhan-limit-scrap was found to contain malicious code. Source: ghsa-malware...
Malicious code in @quick-start-soft/quick-markdown-print (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49e82ae5f39d0c568ce2ebb23ff053c97eba1c0bb306b946c3fefc4c0680b526 The package @quick-start-soft/quick-markdown-print was found to contain malicious code. Source: ghsa-malware...
Python-Based WhatsApp Worm Spreads Eternidade Stealer Across Brazilian Devices
Cybersecurity researchers have disclosed details of a new campaign that leverages a combination of social engineering and WhatsApp hijacking to distribute a Delphi-based banking trojan named Eternidade Stealer as part of attacks targeting users in Brazil. "It uses Internet Message Access Protocol...
Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack
Cybersecurity researchers are calling attention to a large-scale spam campaign that has flooded the npm registry with thousands of fake packages since early 2024 as part of a likely financially motivated effort. "The packages were systematically published over an extended period, flooding the npm...
MAL-2025-132578 Malicious code in colorful_worm_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9057f8ce5af01e40fa7eca02dc9ddada7a8d5dee420331dbe2daf473f3581583 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-97743
Malicious code in jitterywormz3n npm...
Malicious code in jittery_worm_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11fb4f004db7bdeef7aa4f87ae08285749e84f193e5e441f00aab1e239a8d4cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-105310
Malicious code in fatalwormz3n npm...
EUVD-2025-95744
Malicious code in privatewormz3n npm...