Malicious code in @caspianph/storyteller (npm)

Source: amazon-inspector 3bd24daaa395f2e6bfae7c6e6f488a6e114b87e2606ec1bce7dcd4ab6a92f40a The package ships setup.cjs containing heavily obfuscated JavaScript with hex-mangled identifiers 0x32549a, 0x4b2b44, 0x78c349, 0x119ac2 typical of payload-hiding techniques. A file named setup.cjs in an npm...

Malicious code in @caspianph/storyteller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bd24daaa395f2e6bfae7c6e6f488a6e114b87e2606ec1bce7dcd4ab6a92f40a The package ships setup.cjs containing heavily obfuscated JavaScript with hex-mangled identifiers 0x32549a, 0x4b2b44, 0x78c349, 0x119ac2 typical of...

MSC-2026-6173

npm supply chain attack on the @mastra Mastra AI organization: a maintainer account takeover trojanized 140+ packages, each adding a phantom typosquat dependency, [email protected]. Its postinstall hook runs an obfuscated setup.cjs dropper...

MSC-2026-6172

npm supply chain attack on the @mastra Mastra AI organization: a maintainer account takeover trojanized 140+ packages, each adding a phantom typosquat dependency, [email protected]. Its postinstall hook runs an obfuscated setup.cjs dropper...