MAL-2026-4148 Malicious code in miz (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3952 Malicious code in @antv/g-plugin-rough-svg-renderer (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3850 Malicious code in @antv/algorithm (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3883 Malicious code in @antv/f-lottie (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3871 Malicious code in @antv/dipper-hooks (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3958 Malicious code in @antv/g-plugin-yoga (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3978 Malicious code in @antv/g2-plugin-slider (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in lint-md-cli (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3982 Malicious code in @antv/g6 (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4090 Malicious code in @antv/torch (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3950 Malicious code in @antv/g-plugin-physx (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in org.mvnpm:posthog-node (Maven)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security ea90a5928d7667bed4fa9f6effbbe6c8d3ad6521ca51ca2b01551bc02373a7d2 This package was compromised by the Sha1-Hulud: The Second Coming NPM worm. The malicious payload steals tokens and credentials and...

Malicious code in @oku-ui/slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71cb82e7b11eea9aa7260ed7a7e31a29e21d10d81735768c536e42ee88d28b71 The package @oku-ui/slider was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 085e9cbdb891d5b550a81a42584b1cdd8ab001a9443b162158aa633ce18b1e06 The package @oku-ui/arrow was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/radio-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feaa1ad942366c27b4456d59ddcb38dea5f41fbdf8339bfa04ecc8afb48040c0 The package @oku-ui/radio-group was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/primitive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f1bc2783e4344a88f89cf7274b47f7dfb07c2b50833945b40a060a10a7f0092 The package @oku-ui/primitive was found to contain malicious code. Source: google-open-source-security...

Malicious code in command-irail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e642a4e9c3c0f2a51f790c6cbc5aac4db1aeea9f3b7e2818441aaf072159ada9 The package command-irail was found to contain malicious code. Source: ghsa-malware d205be92bee9a5d776450361e21b39a2f5489d337a73198400e070452f2fc6e3...

Malicious code in @afetcan/storage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4abbde27cce56326711e4e32f42572cb60977ca7ccce4ebf1fcfa558a847c1a6 The package @afetcan/storage was found to contain malicious code. Source: google-open-source-security...

Malicious code in @oku-ui/direction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 572259c931f7e9ea0c8cd7b3beead49e6d4c490154b7f692c0547ea136c2b6b4 The package @oku-ui/direction was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191298 Malicious code in @posthog/postgres-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10be24eebbc464a61788d5c151ce03171d4abe4b1cd7f27972fef642fc46deda The package @posthog/postgres-plugin was found to contain malicious code. Source: google-open-source-security...