EUVD-2025-143633

Malicious code in aaku-lia-tea npm...

EUVD-2025-146876

Malicious code in uinsu-lost-dauu npm...

EUVD-2025-149329

Malicious code in teagood-nalikami8 npm...

MAL-2025-142606 Malicious code in fornax-apollo-dependencies-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19d63b4026e2998bfa09edf925373b6179b99d47e1d6cbe6439ca7a0b37dad39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74544

Malicious code in improvedtahrsapphire-44 npm...

EUVD-2025-78626

Malicious code in peculiarsmeltz3n npm...

EUVD-2025-60243

Malicious code in contemporarylemurz3n npm...

EUVD-2025-46787

Malicious code in kresna-mie21-sukiwir npm...

MAL-2025-49623 Malicious code in yanti-bubur64-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35f5ffe88c21f8bb9edf1214e30f22f9733b97016ce03b14c609fc8ea5c35ac4 The package yanti-bubur64-sukiwir was found to contain malicious code...

MAL-2025-48629 Malicious code in dhemrdhs60214 (npm)

The package dhemrdhs60214 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-48717 Malicious code in ldhpgemrdhs51214 (npm)

The package ldhpgemrdhs51214 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-48628 Malicious code in dhemrdhs60152 (npm)

The package dhemrdhs60152 was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-191634 Malicious code in humunculous5910 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 653da18ccefceb9c2bc1dc858e100bcc242e88b449225e1c9337487da1af3826 Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper. --- Category: PROBABLYPENTEST - Packages looking lik...

MAL-2025-191655 Malicious code in rando0192490 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7d5805a2205690aef1009d3bec77df6c20de9d16fc8744b8e44f279bcc2ddab8 Packages that either reports home installation, simulate malicious activity or imitate Roblox API wrapper. --- Category: PROBABLYPENTEST - Packages looking lik...

MAL-2025-47680 Malicious code in inicontohrcekak (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47609 Malicious code in actix-web (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-47433 Malicious code in epc-help-widget (npm)

The package epc-help-widget was found to contain malicious code...

CVE-2025-59037

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware along with several other packages. An attacker published new versions of four of DuckDB's packages that included malicious code to...

CVE-2025-59039 Prebid Universal Creative on npm briefly compromised

Prebid Universal Creative PUC is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should s...

CVE-2025-59039

The CVE-2025-59039 incident concerns Prebid Universal Creative (PUC), a JavaScript API used to render multiple formats. NPM users of PUC 1.17.3 or the latest release were briefly affected by crypto-related malware, including via the popular jsDelivr hosting of the PUC file. In response, maintaine...