MAL-2025-191217 Malicious code in @everreal/web-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77c0514435a2fcfbbc44b6691737ce9fa17b0397b9cbd490173d9dca9fa18adc The package @everreal/web-analytics was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199321

Malicious code in @everreal/web-analytics npm...

Malicious code in @everreal/web-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77c0514435a2fcfbbc44b6691737ce9fa17b0397b9cbd490173d9dca9fa18adc The package @everreal/web-analytics was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199322

Malicious code in @everreal/validate-esmoduleinterop-imports npm...

EUVD-2025-199323

Malicious code in @everreal/react-charts npm...

MAL-2025-191215 Malicious code in @everreal/react-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5768b8f3a3e5bd1a30a71e7ec2dccf1b55e7e06c7967fe7f40bb6cd938104716 The package @everreal/react-charts was found to contain malicious code. Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

@everreal/react-charts (>=1.0.0 <=1.0.1-ff20697), @everreal/web-analytics (>=0.0.3 <=0.0.12) +1 more potentially affected by unknown CVE via undefsafe-typed (=1.0.2)

undefsafe-typed NPM version =1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on undefsafe-typed and may be impacted: - @everreal/react-charts =1.0.0, =0.0.3, =1.1.17, =1.2.5 Source cves: unknown CVE Source advisory: SNYK:JS-UNDEFSAFETYPED-14103745...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...