MAL-2026-3995 Malicious code in @antv/g6-react-node (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in async-http-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 85e8a68bad6595a817f1dabed757662e2a04cfec7b45a86d9bfd61a7a78d14d1 During installation, package exfiltrates some basic info to a GitHub issue comment, and then attempt to set up a persistent infostealer focused on exfiltrating...

Malicious code in i-wls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4403e46e10206e7c0b1c77bf4a27f6c3be2d94aedb52ba77ab8801902df948a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...