EUVD-2025-199312

Malicious code in @hover-design/core npm...

@hover-design/react (>=0.2.1-beta <=0.2.4-beta) potentially affected by unknown CVE via @hover-design/core (=0.0.1-beta)

@hover-design/core NPM version =0.0.1-beta is affected by a known vulnerability. The following packages have a transitive dependency on @hover-design/core and may be impacted: - @hover-design/react =0.2.1-beta, =0.2.4-beta Source cves: unknown CVE Source advisory: OSV:MAL-2025-191226...

MAL-2025-191226 Malicious code in @hover-design/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b03af3ac7b52b07f33bbcc22eb9afad4255a3c9c5f5ce300953bbedb4193751e The package @hover-design/core was found to contain malicious code. Source: ghsa-malware...

Malicious code in @hover-design/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b03af3ac7b52b07f33bbcc22eb9afad4255a3c9c5f5ce300953bbedb4193751e The package @hover-design/core was found to contain malicious code. Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...