Malicious code in size-sensor (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

@21epub/matomo-echarts-components (>=0.1.0 <=0.1.21), @abtnode/ux (>=1.16.40 <=1.17.12-beta-20260422-093007-b389a838) +1339 more potentially affected by unknown CVE via size-sensor (>=1.0.1 <=1.0.3)

size-sensor NPM version =1.0.1, =0.1.0, =1.16.40, =0.1.1, =0.0.1, =0.1.1, =0.1.0, =0.0.2, =0.26.6, =0.1.2, =0.0.3, =0.1.0, =0.0.2-7.1, =1.1.15, =1.1.24 and more Source cves: unknown CVE Source advisory: OSV:MAL-2026-4153...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...