Malicious code in @mastra/google-cloud-pubsub (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1bd3f8519d6016a066d4268dae0e9c0d20ca87350cc759832b6053128a5b8d8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6024 Malicious code in @mastra/google-cloud-pubsub (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1bd3f8519d6016a066d4268dae0e9c0d20ca87350cc759832b6053128a5b8d8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

io.quarkiverse.googlecloudservices:quarkus-google-cloud-bigtable (0.5.0), io.quarkiverse.googlecloudservices:quarkus-google-cloud-bigtable-deployment (0.5.0) +83 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.12.0.final)

io.quarkus:quarkus-vertx MAVEN version 1.12.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkiverse.googlecloudservices:quarkus-google-cloud-bigtable 0.5.0 -...