Malicious code in @onereach/idw-apps (npm)

npm/@onereach/idw-apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @or-sdk/tickets (npm)

npm/@or-sdk/tickets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: prometheus, gitaly, envconsul, filebrowser, ko, rancher-fleet, cerbos, fuse-overlayfs-snapshotter, policy-controller, kine, terraform, kube-arangodb, opa-envoy, aws-flb-kinesis, kind, neuvector-scanner, weaviate, cilium-cli, prometheus-operator, podman, cert-manager,...

GHSA-M4PR-4J3G-9V7V vulnerabilities

Vulnerabilities for packages: helm-push, metacontroller, kubernetes-ingress-defaultbackend-fips, crossplane-provider-aws-ssm, eks-node-monitoring-agent, xeol, kube-oidc-proxy, nats-top-fips, spqr, kubernetes-dashboard-metrics-scraper-fips, kubernetes-csi-driver-nfs, kubescape-http-request-fips,...

Malicious code in py-infopiplgtb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7a554864c67e1208f5c45369e15f8169d30257402cd480e517547f7b4fdf7b90 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in libgrandint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5a8ce90bf68ce36f12624df7262d8e4d5da9824b6e9f28a4a87f7ffdb6f5df2d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqstringnvidia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8bc83f0d955a843c0eb6b2c34fe22424c9fd7dcdebd0075eb89f5966cd027bdb EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in craftgame (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 870d9cb8a8d09370325646ee1eb8f16f86b00e17785d1c5d10cbd9b3cd865b63 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tkcaalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 954677803cf5ebe654bfd7eedd0a3164de3ac7c292e6f8d0c262c076f8b02728 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in ycodestyle (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fffb5ae3e1f41a6b55f5c5ce485edd1290ef043de7ee30f907a21dc4ccb016b0 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in prompt-tookit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5d92327d14ed9c546cc8da4686d6444e8618ca3ee12fa7dcc1e887f63378235e Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in xlsxwrtier (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 38e1ab75b1064d2fa63893a585adf60c88b1e88a47afeaed606553dd7d98dcb5 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in sloana (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 25898ab1b9774b92af1f740bfd1366de9381ea6feb7f1c184d7abf8c375d5ac8 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...