Malicious code in @hubsync/web-sdk-react (npm)

npm/@hubsync/web-sdk-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2025-94197 Malicious code in elderly_fish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ad3930a467356e1d252bd1a3dbda398c7f4b4d43e671c73989352cc365761ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dian-tapai77-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f95259dafb41e84ec9f9f031746bc1e243f93a43df0bedf39e1d384df7988aca The package dian-tapai77-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...