MAL-2026-6170 Malicious code in onesignal-hooks (npm)

The npm package onesignal-hooks published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2025-173302 Malicious code in buta-faa-siagfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f34b4973d68072f91db00982b5c051e092b1bcdb78f8809b66575121977341d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...