Malicious code in @onereach/orest-input-cli (npm)

npm/@onereach/orest-input-cli is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2025-151330 Malicious code in abih-poke4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e72cbb08662af8222acff51ffc38c2df0124e6bc7bd24daf26ceba7e47a724a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150772 Malicious code in @miptaa02/ivao (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db2e85b819c0d638abb621dbaa4127018b4a6980d88fbd2d3698aefb99b125e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...