safe-npm

safe-npm 安全な npm インストーラー。新たに侵害されたパッケージからプロジェクトを保護します。 なぜこれが必要なのか？ npm パッケージへのサプライチェーン攻撃は増大する脅威です。攻撃者は正規のパッケージを侵害することがあります。その手段は次のとおりです。 メンテナの認証情報を盗む 人気パッケージに悪意のあるアップデートを公開する 放棄されたパッケージを乗っ取る こうした攻撃は突然発生することがよくあります。昨日まで安全だったパッケージが今日は侵害されている可能性があります。safe-npm は、公開から一定期間（デフォルトで 90...

compromised-packages

이 저장소에는 README가 없습니다...

cve-2025-54313

cve-2025-54313 프로젝트에서 손상된 패키지, 의심스러운 파일 및 import 문을 확인합니다. Supply Chain 공격 참조 어떻게? 터미널/콘솔에서 스크립트를 실행하기만 하면 됩니다. 먼저 maple을 설치하는 것이 좋습니다. root@kitploit: npm install -g maple chmod +x cve-2025-54313.sh ./cve-2025-54313.sh 라이선스 GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright C 2007 Free...

Malicious code in @qlik/eslint-config-base (npm)

npm/@qlik/eslint-config-base is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @qlik/carbon-core (npm)

npm/@qlik/carbon-core is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in @qlik/eslint-config-svelte (npm)

npm/@qlik/eslint-config-svelte is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11935 Malicious code in @servicetitan/titan-chat-ui (npm)

npm/@servicetitan/titan-chat-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11817 Malicious code in @servicetitan/anvil-icon (npm)

npm/@servicetitan/anvil-icon is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/temporal-lite (npm)

npm/@servicetitan/temporal-lite is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/admin-sql-table (npm)

npm/@servicetitan/admin-sql-table is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11883 Malicious code in @servicetitan/ko-bridge (npm)

npm/@servicetitan/ko-bridge is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11898 Malicious code in @servicetitan/measure-sheet-data (npm)

npm/@servicetitan/measure-sheet-data is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized an...

MAL-2026-11663 Malicious code in @onereach/v-event-calendar (npm)

npm/@onereach/v-event-calendar is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/si-code (npm)

npm/@onereach/si-code is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

Malicious code in @onereach/ui-components-common (npm)

npm/@onereach/ui-components-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @or-sdk/invitations (npm)

npm/@or-sdk/invitations is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11655 Malicious code in @onereach/step-voice (npm)

npm/@onereach/step-voice is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

Malicious code in @or-sdk/apps (npm)

npm/@or-sdk/apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the...

Malicious code in @onereach/orest-vue-demi-vue3 (npm)

npm/@onereach/orest-vue-demi-vue3 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @ornikar/lerna-config (npm)

npm/@ornikar/lerna-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...