MAL-2026-6424 Malicious code in leo-connector-mongo (npm)

The leo-connector-mongo npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

Malicious code in gleaming_crow_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 505f911c5c2b2567a211ac4622b2b5ef94396b4b0132607297b5e59886e821e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in esqcontrolad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 92c38f2d2ef995b09bee279fe7a9d7ded286b0bb29bb201eb010e5eb4c4ff549 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...