Malicious Package

Overview tailwind-styled-scrollbar is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

EUVD-2025-197735

Malicious code in tailwind-styled-scrollbar npm...

EUVD-2025-197732

Malicious code in com.mixpanel.unity npm...

EUVD-2025-197706

Malicious code in filifecycleserv-paypal npm...

CVE-2025-13204

The expr-eval and expr-eval-fork npm packages are vulnerable to Prototype Pollution due to improper handling of JavaScript prototype-based inheritance in the eval interface . An attacker with access to the express eval interface can exploit this flaw to achieve arbitrary code execution . This vul...

EUVD-2025-197614

npm package expr-eval is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution. The npm expr-eval-fork package resolves this issue...

Malicious code in loger-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bae5da3bd8d27a466a9c283448407d51b93d85d73a97a5db78f46b3635cd3a4 The package loger-parser was found to contain malicious code. Source: ghsa-malware c75c0239d03c0dc3d95b5965598d3d59e96ce5a1826fc60aaba3dd34da283a2b A...

EUVD-2025-180550

Malicious code in loger-parser npm...

EUVD-2025-180551

Malicious code in tailwindcss-setflex npm...

EUVD-2025-180554

Malicious code in chai-test-async npm...

EUVD-2025-177180

Malicious code in com.unity.polyspatial npm...

EUVD-2025-175355

Malicious code in form-classifier npm...

EUVD-2025-175356

Malicious code in bitsight npm...

Malicious code in form-classifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aee6a6945bad04a1ec3fbe89e2cbe5013625ba025601a3df6678a125761d3b55 The package form-classifier was found to contain malicious code...

Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

Cybersecurity researchers are calling attention to a large-scale spam campaign that has flooded the npm registry with thousands of fake packages since early 2024 as part of a likely financially motivated effort. "The packages were systematically published over an extended period, flooding the npm...

EUVD-2025-175386

Malicious code in @walletify/core npm...

EUVD-2025-175385

Malicious code in @walletify/ui npm...

Malicious code in @walletify/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47d10b25587929b2987efd39df23877c3753147c431eb456cef63e175e70588c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-175384

Malicious code in @walletify/backend npm...

Malicious code in arcturus-bellatrix-standard-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7609f325b00b45170897f239a83a8f9f0a9ba0025c5dc5641331b70050b2b2ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...