Malicious Package

Overview bellatrix-mira-europa-commitlint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-63187

Logto (open-source auth infrastructure) versions 1.40.1 through 1.41.0 contain an OS command injection in the .github/workflows/commitlint.yml workflow. The github.event.pull_request.title value was directly interpolated into an inline echo command before being piped to npx commitlint. A pull req...

CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

Malicious code in @ornikar/commitlint-config (npm)

npm/@ornikar/commitlint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @voiceflow/commitlint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0318a598c3e523953b57c870305c3d1237a290a253f3d69dd9f24bf6ba079d6e The package @voiceflow/commitlint-config was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199423

Malicious code in @voiceflow/commitlint-config npm...

EUVD-2025-180478

Malicious code in airbnb-oscillation-commitlint-config-angular-palynology npm...

EUVD-2025-179636

Malicious code in commitlint-chalk-eclipse-init npm...

EUVD-2025-180113

Malicious code in bellatrix-mira-europa-commitlint npm...

Malicious code in commitlint-config-angular-nodejs-carpo-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff6171864c8dd888f734cabf61ae22f26f3868044dd59eb396032310cdbcf72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176558

Malicious code in sagitta-polaris-configstore-commitlint-config-angular npm...

EUVD-2025-179626

Malicious code in commitlint-resolvers-procyon-pm2 npm...

EUVD-2025-179634

Malicious code in commitlint-config-angular-forever-dotenv-parse-variables-google npm...

EUVD-2025-176047

Malicious code in taurus-heliophysics-commitlint-config-angular-superposition npm...

EUVD-2025-177567

Malicious code in node-sass-commitlint-lynx-public npm...

EUVD-2025-177526

Malicious code in nova-quantum-protractor-commitlint npm...

EUVD-2025-180112

Malicious code in bellatrix-odin-redis-commitlint npm...

EUVD-2025-179406

Malicious code in dagda-technocracy-commitlint-gacrux npm...

EUVD-2025-180329

Malicious code in ariel-callisto-commitlint-config-angular-install npm...

Malicious code in commitlint-resolvers-procyon-pm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c84a42a0bd7b27857197441ce982e9035d4e93ebf009d7bb23942627d9ce0b70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...