MAL-2025-190828 Malicious code in @trigo/atrix-pubsub (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 774898dc5178ad4bd2128a0ec966ceb51a9cc46c9884a0618869d7525c96260c The package @trigo/atrix-pubsub was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190826 Malicious code in @strapbuild/react-native-perspective-image-cropper-2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e2f74d9d1d21777c83aa98d57c78a19a6161665a8af16c87f380f0d5b8139e The package @strapbuild/react-native-perspective-image-cropper-2 was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190766 Malicious code in capacitor-purchase-history (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ef54df7bce3add5d55de2f91510b75ffc757c47626010c4f44b59ef8f08242c The package capacitor-purchase-history was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190778 Malicious code in posthog-plugin-hello-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 411e53a1772704343ddb3da6957e8e0ee4e8167ec93030bf27e2247081fddc61 The package posthog-plugin-hello-world was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190715 Malicious code in @asyncapi/java-spring-cloud-stream-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b7ee33a69d9005442fb0347dfb87c303e2acd8cd146d8a85d0cecdc90f94bc3 The package @asyncapi/java-spring-cloud-stream-template was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/blacklist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b443e4475d3f0306ce0899d0afd3b9190193bac49fa411c41328695e05a46 The package @ensdomains/blacklist was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190730 Malicious code in @ensdomains/ens-avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01d42aa5d8e1550b42c3f000d426b136d2f0a271a88bb0779306c670ab6c0613 The package @ensdomains/ens-avatar was found to contain malicious code. Source: ghsa-malware...

Malicious code in @trigo/atrix-soap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39b1328f74edf78d2b44ee487b5ea36c148e8b07a8f3bb83240f4adaa4b6c0f5 The package @trigo/atrix-soap was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190716 Malicious code in @asyncapi/java-spring-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bb0637829fe4777b541f94a01279132c65a2d361e3d762ce0a08dd813e7fd5f The package @asyncapi/java-spring-template was found to contain malicious code. Source: ghsa-malware...

Malicious code in @actbase/react-native-tiktok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e30674f65fae1c8cebcf4d015086a943502402cc93f3559653c406c592a62366 The package @actbase/react-native-tiktok was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190659 Malicious code in @asyncapi/markdown-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eab3f67164575b589affd305405ab98f13239b541ad15720274e6657e7f6571 The package @asyncapi/markdown-template was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b13eec1644f2d38922b7e61732a64ae6ee0d71810232ff15c95a3290de465d The package @asyncapi/cli was found to contain malicious code. Source: ghsa-malware 99e5bdb2a7d429f7e01403c432963826b244c3bed02a5a877ace1307b5fee3ad...

MAL-2025-190642 Malicious code in @asyncapi/react-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9ebe88915a6eee986912a6566783764ff832588763eaa7b763710ed9f992299 The package @asyncapi/react-component was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-178361

Malicious code in io-gulp-apollo-javascript npm...

EUVD-2025-137941

Malicious code in flights-lutuig-adinolo npm...

EUVD-2025-134349

Malicious code in kiudt-acog-efiuivucafav npm...

EUVD-2025-133556

Malicious code in teate-thy-sonic-awhaw npm...

EUVD-2025-139789

Malicious code in nokire-nakaocil19 npm...

EUVD-2025-145458

Malicious code in isabellejones npm...

Malicious code in astia-alo1f-danaipik (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06dc98109197fb19f0fba5193e926477f9255b54cd85a576ac6624fbca37f7e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...