Malicious code in @onereach/types-contacts-api (npm)

npm/@onereach/types-contacts-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in psuutil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 71840b4eaafce178353cc51cd2db42fd77b71973710b0701befec4bebc249ef4 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...