Malicious code in @antv/lite-insight (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/x6-plugin-clipboard (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-4136 Malicious code in jest-canvas-mock (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

Malicious code in @ctrl/qbittorrent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af92aa639259dc9a287445d9fdbb2ec61beeb5adf71ff13a6e8f9bceb79971a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6012 Malicious code in grayavatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24a840f69e770a8a7f48a5cd9ce41432db11d5c5f9f0cc48c3d64dda80c93fad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5212 Malicious code in audible-react-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e390437d447abf7cd857a317c79c2904de3c54d6ad86d8fcd26b65a13ecd6a59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4511 Malicious code in stylelist-plugins (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a745d261f9e0527178f8d66fc90fa8e670e4112d2fb66d739750db3840dd35df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6744 Malicious code in uglpti9f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5708a7125d246cbcfa82d8f0b5ce76a91aab70187c166c079cc4a0560ec7e07d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...