MAL-2025-191177 Malicious code in @accordproject/template-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9523084c03eecff384f8441a619316a1459bbd50b076f93f0c0175db405a2c4f The package @accordproject/template-engine was found to contain malicious code. Source: ghsa-malware...

Malicious code in @accordproject/template-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9523084c03eecff384f8441a619316a1459bbd50b076f93f0c0175db405a2c4f The package @accordproject/template-engine was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199344

Malicious code in @accordproject/template-engine npm...

EUVD-2025-199345

Malicious code in @accordproject/markdown-it-cicero npm...

Malicious code in @accordproject/markdown-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa9047c76812b92b2e951857e7b8b36154b6662c2483ca7528bfa6af593c69c7 The package @accordproject/markdown-cli was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191449 Malicious code in @accordproject/markdown-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa9047c76812b92b2e951857e7b8b36154b6662c2483ca7528bfa6af593c69c7 The package @accordproject/markdown-cli was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199519

Malicious code in @accordproject/markdown-cli npm...

MAL-2025-191174 Malicious code in @accordproject/concerto-metamodel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1581131b6f7d752a2f26c167db5c144e33b737febc23f3e156f76a1b68e763ae The package @accordproject/concerto-metamodel was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199347

Malicious code in @accordproject/concerto-metamodel npm...

MAL-2025-191172 Malicious code in @accordproject/concerto-linter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a266ef73fe4cd4e7227a57de2c97b342daf2ae0aed81e06b41bd9a55ab02d24 The package @accordproject/concerto-linter was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199350

Malicious code in @accordproject/concerto-analysis npm...

MAL-2025-191171 Malicious code in @accordproject/concerto-analysis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4dfaf2dbfd72597ed98e94903934d34e97ddd5dc4f7aeb7f5450767cb3a34c The package @accordproject/concerto-analysis was found to contain malicious code. Source: ghsa-malware...

@accordproject/concerto-metamodel contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

3loc (>=0.1.0 <=0.4.0), @accordproject/cicero-cli (>=0.3.4 <=0.20.11-20200413151148) +986 more potentially affected by CVE-2023-2142 via nunjucks (>=0.1.10 <=3.2.3)

nunjucks NPM version =0.1.10, =0.1.0, =0.3.4, =0.3.12-20180525105709, =0.3.4, =0.3.4, =0.11.2-20190326183124, =0.0.5, =0.1.0, =1.1.0-301, =1.3.2, =2.0.0, =0.0.5, =1.2.0, =1.4.0 - @asephermann/capacitor-filechooser =0.0.1 and more Source cves: CVE-2023-2142 Source advisory: OSV:GHSA-X77J-W7WF-FJMW...

@accordproject/cicero-cli (>=0.3.4 <=0.24.1-20231019073743), @accordproject/cicero-common (>=0.3.4 <=0.3.12) +450 more potentially affected by CVE-2022-1243 via urijs (>=1.16.1 <=1.19.10)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.0.5, =0.71.8-20190915045234, =0.80.2, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616, =0.6.0-alpha.0, =0.6.0, =0.91.1-20200514222339 and mor...

@accordproject/cicero-cli (>=0.3.4 <=0.21.27-20210409091004), @accordproject/cicero-common (>=0.3.4 <=0.3.12) +445 more potentially affected by CVE-2022-0868 via urijs (>=1.16.1 <=1.19.1)

urijs NPM version =1.16.1, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.4.5-20180705184508, =0.11.2-20190326183124, =0.10.2-20190213145246, =0.0.5, =0.71.8-20190915045234, =0.80.2, =0.80.4-20191003231621, =0.61.2-20190916200303, =0.90.1-20200514190616, =0.6.0-alpha.0, =0.6.0, =0.91.1-20200514222339 and mor...

3d-preview (>=1.0.0 <=1.0.1), 3dviewercomponent (=1.0.0) +4850 more potentially affected by unknown CVE via js-yaml (>=0.3.5 <=3.13.0)

js-yaml NPM version =0.3.5, =1.0.0, =0.0.2, =0.0.1, =1.1.0, =3.3.4, =0.2.0-beta.6.2, =0.2.48, =0.2.50, =0.2.46, =0.2.46, =0.2.46, =0.0.37, =0.4.4 and more Source cves: unknown CVE Source advisory: OSV:GHSA-8J8C-7JFH-H6HX...