EUVD-2025-199335

Malicious code in @browserbasehq/stagehand-docs npm...

MAL-2025-191194 Malicious code in @browserbasehq/director-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b86bd8a3bb8b027a0b305fca0e5616b1f8cfee1229e47609ef43a14edb2ad0c6 The package @browserbasehq/director-ai was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191209 Malicious code in @commute/market-data-chartjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e906d8b501e2641730640922fb6196f422637e4fa3c7eb6e5823dc3f6301026c The package @commute/market-data-chartjs was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191205 Malicious code in @clausehq/flows-step-taskscreateurl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aea06d73112475520b51b21f45ccc22e8ddcf55245e7045f7efcdeefda036595 The package @clausehq/flows-step-taskscreateurl was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199334

Malicious code in @chtijs/eslint-config npm...

@actbase/react-native-fast-image contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-kakaosdk contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/node-server contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@accordproject/markdown-it-cicero contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

@actbase/react-native-simple-video contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...

EUVD-2025-199301

Malicious code in @lui-ui/lui-vue npm...

MAL-2025-191245 Malicious code in @lui-ui/lui-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b88c15ab970fa80e2c420db246728871b310f27e35371206322bf8cea6abb1 The package @lui-ui/lui-vue was found to contain malicious code. Source: ghsa-malware 339d88eca55085f7dbfd769a5800adf59a499c0e6e14500a6f456cf17ec249f...

EUVD-2025-199270

Malicious code in quickswap-token-lists npm...

EUVD-2025-199302

Malicious code in @lui-ui/lui-tailwindcss npm...

EUVD-2025-199272

Malicious code in quickswap-sdk npm...

EUVD-2025-199273

Malicious code in quickswap-router-sdk npm...

Malicious code in quickswap-router-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed80b7ba4c6742a8930246967edfa6fc147fc7a52d957d93c89ce0a9258bd470 The package quickswap-router-sdk was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199274

Malicious code in quickswap-default-token-list npm...

Malicious code in quickswap-default-token-list (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4b3edd2c22842f2e65d4b70184d67745f91228b3e8a335561def81900e84ddd The package quickswap-default-token-list was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191239 Malicious code in @kvytech/habbit-e2e-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bc98f56e53ded216f20185150816d9ee319d2e9570684bb920a024c92fae93 The package @kvytech/habbit-e2e-test was found to contain malicious code. Source: ghsa-malware...