@accordproject/concerto-metamodel contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-native-naver-login contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/template-engine contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/markdown-it-cicero contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/concerto-linter contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/concerto-linter-default-ruleset contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/node-server contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-kakaosdk contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

Improving the Identification of Real-World Malware's DNS Covert Channels Using Locality Sensitive Hashing

Nowadays, malware increasingly uses DNS-based covert channels in order to evade detection and maintain stealthy communication with its command-and-control servers. While prior work has focused on detecting such activity, identifying specific malware families and their behaviors from captured...

@actbase/react-native-kakao-navi contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-native-less-transformer contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/native contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/concerto-types contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-native-devtools contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

Malicious code in quickswap-default-token-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4b3edd2c22842f2e65d4b70184d67745f91228b3e8a335561def81900e84ddd The package quickswap-default-token-list was found to contain malicious code. Source: ghsa-malware...

Malicious code in @kvytech/habbit-e2e-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bc98f56e53ded216f20185150816d9ee319d2e9570684bb920a024c92fae93 The package @kvytech/habbit-e2e-test was found to contain malicious code. Source: ghsa-malware...

Malicious code in valuedex-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7604b9b49dff9ce4a66119dcd337c975d53e669752a1964d523b95bce8b96761 The package valuedex-sdk was found to contain malicious code. Source: ghsa-malware 14bcd330b75ba074bb0ea2ba295bf74570677a718d844ef4f7e18fbd051594da A...

MAL-2025-191234 Malicious code in @hyperlook/telemetry-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc89d8ae1e7f05dd930ed4c9173e00320153c6bb111324358e1c6f43bc07a1db The package @hyperlook/telemetry-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191442 Malicious code in uniswap-smart-order-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbda3147fde915a97ddd97f51f5ebc1757fa14bca7cad95f333862ad125c3c1 The package uniswap-smart-order-router was found to contain malicious code. Source: ghsa-malware...

Malicious code in @hover-design/react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50c066ac501de3af9fd156e23b5fb0317b633da301c4cf66b12f2ae8429e0970 The package @hover-design/react was found to contain malicious code. Source: ghsa-malware...