Malicious code in tslint-folder-schema (npm)

npm/tslint-folder-schema is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...

MAL-2026-11934 Malicious code in @servicetitan/time-zones (npm)

npm/@servicetitan/time-zones is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/mfe-quick-actions (npm)

npm/@servicetitan/mfe-quick-actions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @ornikar/apollo-link-timeout (npm)

npm/@ornikar/apollo-link-timeout is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2025-170814 Malicious code in ameerhussain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45696d279943f3b0ff78a49914b278c0254b8c9d27e1237fcc988f64dbccd7f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113880 Malicious code in fajar-ruwet2-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93bfc4097f35150abe451d0b8479f1b04eef6be598f889a5d94a1c564ec2b90 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...