Malicious code in shelf-jwt-sessions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bccf31522a4305a972564f73554c2b148fd28428cce67b3e73edd235aec25a84 The package shelf-jwt-sessions was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191294 Malicious code in @posthog/laudspeaker-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d44feed9d3d00b551ce5d190d7fba454ffbe5757b5a52eeb4c765bf70543d88c The package @posthog/laudspeaker-plugin was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191320 Malicious code in @silgi/yoga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c8aabbdab5840682c4f335a1ae8ff93ff305af445e00bacb5f10b1fd85b7ba1 The package @silgi/yoga was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191210 Malicious code in @dev-blinq/ai-qa-logic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bcfefccc1ff9a7579321c6e45d16fc6aa94b9eaa45952fe47d415c2ffcde9a4 The package @dev-blinq/ai-qa-logic was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199268

Malicious code in ra-auth-firebase npm...

Malicious code in @alexadark/reusable-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40b60eadf9a59b630bca0ffcb8e9f5cec6b410c01cd856384df7caaff08880f9 The package @alexadark/reusable-functions was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199340

Malicious code in @alexadark/reusable-functions npm...

MAL-2025-191183 Malicious code in @alexadark/gatsby-theme-wordpress-blog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 110819ca12a8190932562305cd8ee1c97b0e61434f5e12e238bc9eaa46350de5 The package @alexadark/gatsby-theme-wordpress-blog was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199345

Malicious code in @accordproject/markdown-it-cicero npm...

EUVD-2025-199519

Malicious code in @accordproject/markdown-cli npm...

EUVD-2025-199346

Malicious code in @accordproject/concerto-types npm...

EUVD-2025-199348

Malicious code in @accordproject/concerto-linter-default-ruleset npm...

EUVD-2025-199349

Malicious code in @accordproject/concerto-linter npm...

EUVD-2025-199350

Malicious code in @accordproject/concerto-analysis npm...

EUVD-2025-199335

Malicious code in @browserbasehq/stagehand-docs npm...

MAL-2025-191194 Malicious code in @browserbasehq/director-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b86bd8a3bb8b027a0b305fca0e5616b1f8cfee1229e47609ef43a14edb2ad0c6 The package @browserbasehq/director-ai was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191209 Malicious code in @commute/market-data-chartjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e906d8b501e2641730640922fb6196f422637e4fa3c7eb6e5823dc3f6301026c The package @commute/market-data-chartjs was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191205 Malicious code in @clausehq/flows-step-taskscreateurl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aea06d73112475520b51b21f45ccc22e8ddcf55245e7045f7efcdeefda036595 The package @clausehq/flows-step-taskscreateurl was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199334

Malicious code in @chtijs/eslint-config npm...

@actbase/react-native-fast-image contains malware after npm account takeover

On November 24th 2025, a new supply chain attack called Shai-Hulud 2.0 was launched. This package contains the malicious code that attempts to harvest credentials and infect GitHub and npm repositories. The malicious software executes during the pre-install phase and attempts to harvest credentia...