Malicious code in @redhat-cloud-services/javascript-clients-shared (npm)

Part of the "Mini Shai-Hulud" supply chain worm campaign that compromised the GitHub Actions OIDC trusted publisher shared by Red Hat Cloud Services npm packages. The attacker injected a preinstall hook into this and 31 other packages in the @redhat-cloud-services scope. The hook delivers a...

MAL-2025-148458 Malicious code in taurus-antares-child-process-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe0fc485095fad750a070495da9a88aa78c72c33bcffa9c5000b8fd69e760da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-92282 Malicious code in wibowo-sego98-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff7df10e8a34c559182600102c2e72c11f9943693c0193a042304f223bdbab83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-79169 Malicious code in joint_hookworm_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e54d5c9975b833197438c911a95a8079a79bf515fdc292df3710470467335a97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...