@actbase/node-server contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/markdown-it-cicero contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/template-engine contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

Improving the Identification of Real-World Malware's DNS Covert Channels Using Locality Sensitive Hashing

Nowadays, malware increasingly uses DNS-based covert channels in order to evade detection and maintain stealthy communication with its command-and-control servers. While prior work has focused on detecting such activity, identifying specific malware families and their behaviors from captured...

@accordproject/concerto-types contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-native-devtools contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-native-less-transformer contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/native contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-native-kakao-navi contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

Malicious code in quickswap-default-token-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4b3edd2c22842f2e65d4b70184d67745f91228b3e8a335561def81900e84ddd The package quickswap-default-token-list was found to contain malicious code. Source: ghsa-malware...

Malicious code in @kvytech/habbit-e2e-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bc98f56e53ded216f20185150816d9ee319d2e9570684bb920a024c92fae93 The package @kvytech/habbit-e2e-test was found to contain malicious code. Source: ghsa-malware...

Malicious code in valuedex-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7604b9b49dff9ce4a66119dcd337c975d53e669752a1964d523b95bce8b96761 The package valuedex-sdk was found to contain malicious code. Source: ghsa-malware 14bcd330b75ba074bb0ea2ba295bf74570677a718d844ef4f7e18fbd051594da A...

MAL-2025-191234 Malicious code in @hyperlook/telemetry-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc89d8ae1e7f05dd930ed4c9173e00320153c6bb111324358e1c6f43bc07a1db The package @hyperlook/telemetry-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191442 Malicious code in uniswap-smart-order-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbda3147fde915a97ddd97f51f5ebc1757fa14bca7cad95f333862ad125c3c1 The package uniswap-smart-order-router was found to contain malicious code. Source: ghsa-malware...

Malicious code in @hover-design/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50c066ac501de3af9fd156e23b5fb0317b633da301c4cf66b12f2ae8429e0970 The package @hover-design/react was found to contain malicious code. Source: ghsa-malware...

Malicious code in samesame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b13e951b583059d1772bdd87c42fa897e1d023144e96e75720d61aa721efbf6 The package samesame was found to contain malicious code. Source: ghsa-malware a7c35b3b06e9c075dec97186d8f347918e3017121b3bc57abb571e172ad7eb61 Any...

MAL-2025-191419 Malicious code in samesame (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b13e951b583059d1772bdd87c42fa897e1d023144e96e75720d61aa721efbf6 The package samesame was found to contain malicious code. Source: ghsa-malware a7c35b3b06e9c075dec97186d8f347918e3017121b3bc57abb571e172ad7eb61 Any...

Malicious code in schob (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d511d3e995fea577f76f98db2b210a390974c05a620e22e87d9cc9a1afe4f09 The package schob was found to contain malicious code. Source: ghsa-malware 93b65cbaaf5b26ea1a1fd10e632fcfd4403760db53ca856573a70ea1bafedb0f Any...

MAL-2025-191420 Malicious code in schob (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d511d3e995fea577f76f98db2b210a390974c05a620e22e87d9cc9a1afe4f09 The package schob was found to contain malicious code. Source: ghsa-malware 93b65cbaaf5b26ea1a1fd10e632fcfd4403760db53ca856573a70ea1bafedb0f Any...

Malicious code in soneium-acs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ef13235ddcf50988ca14c257fc3e88969c7a99cd07389710789ef758dba1f7 The package soneium-acs was found to contain malicious code. Source: ghsa-malware 0dd54268e2cc4c0ffd1059655c96c56400b08d5eb44bdf09753b1aec34aac8fa An...