MAL-2026-7055 Malicious code in @bmg-web/bmg-spinner (npm)

--- -= Per source details. Do not edit below this line.=-...

EUVD-2025-121720

Malicious code in spinner-nuxtjs-dotenv-parse-variables-chromedriver npm...

EUVD-2025-121714

Malicious code in spinner-tailwindcss-sqlite-oauth npm...

EUVD-2025-121535

Malicious code in supervisor-corvus-css-loader-spinner npm...

MAL-2025-143643 Malicious code in inquirer-cli-spinner-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e42be817e5f64c4fcf3dbf7e0780556cf14e706cc97619487c5d0a41962fb9ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121719

Malicious code in spinner-playwright-geckodriver-async npm...

Malicious Package

Overview @ovh-ui/oui-spinner is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...