MAL-2026-663 Malicious code in transform-async-generator-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338773642b9997fc33cd7f4eb7cfbca20019115fc184de55077b8b112a45dcc4 The package transform-async-generator-functions was found to contain malicious code. Source: ghsa-malware...

Malicious code in debug-fmt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 049bf4db6a598df3cc4db93a71b765670e9b94be0c835ae183fd91c13fe99d8b The package debug-fmt was found to contain malicious code. Source: ghsa-malware 1f7e76c50ec40bd53847463f61469ebfb4691c221c290d98fed82736214216cc Any...

MAL-2026-415 Malicious code in dotenv-expanded (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e36cd005779e12b645b7ec5f6e65df1edae7c6d86736507cd1feacec1ef7cf The package dotenv-expanded was found to contain malicious code. Source: ghsa-malware 8c545865cdbec4a05b0f51103dd3560d60c3f43b818465e4a935a47bf84078d...

Malicious code in @mikudev/ridwan-signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c96124a8175a81f43ffbd0c2b9acc96782560b9e737266ccac47204d9605f31 The package @mikudev/ridwan-signal was found to contain malicious code. Source: ghsa-malware...

MAL-2026-179 Malicious code in n8n-nodes-vbmkajdsa-uehfitvv-ueqjhhhksdlkkmz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5b9fc4d665c764917757933148572fd5cfca44be431dd6f84281b068b1ccfc The package n8n-nodes-vbmkajdsa-uehfitvv-ueqjhhhksdlkkmz was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c9efaf89a89b5eb291f14408bbc1259e6b222e9ee9445fc01c33753cdc7688 The package chai-min was found to contain malicious code. Source: ghsa-malware 986779b1404de4f7d2869e5db91f49bd49bc402934a8da2ff0990e656495b5a6 Any...

MAL-2026-158 Malicious code in timeout-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1df00c4c63fa8e52f67bf4d40b5dadae1ddcb640d127546671ce2bf53b5eafa7 The package timeout-ts was found to contain malicious code. Source: ghsa-malware 16cf2a5883796e1a03bb6cc6da0182692fa5962abe42950ba3d95709ca928a71 Any...

Malicious code in garfield777 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3626bdc556c590b7c14c524662be21b2c32762a7f92d11468d00e3b2bc11283c The package garfield777 was found to contain malicious code. Source: ghsa-malware 4f2e8d9e848ec713987e09976d8945d2e64232ae0f12a753838199009b91f361 An...

MAL-2025-192747 Malicious code in excluder-mcp-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44e8a4074afa107f60ef1b93a1b5ad90b034338e5d94eed6d5b1e27fa583b96e The package excluder-mcp-package was found to contain malicious code. Source: ghsa-malware...

Malicious code in dotenv-extend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b36b33fa03b9dafefe167d7891f649dc39ac77a18a67a25c44d0d647dd3518e9 The package dotenv-extend was found to contain malicious code. Source: ghsa-malware 7ef0bc2453e5610efd0011a08cecb1021a4d5a38aee276a269ad3185bb40925a...

Malicious code in @pluxee-design-system/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b95edac344588e8262b1cfdc979c7eb4585329df2ce47b7adc45f23930971e7b The package @pluxee-design-system/core was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191464 Malicious code in mayhem-wma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d242ed0467287371909e2fef415c86d7688c77b9a33f6b43c52d37bfc2d7fa6e The package mayhem-wma was found to contain malicious code. Source: ghsa-malware 9f00d5cfad9006d0cb83e7249554304291a746a42a2191314e1b70990e854df5 Any...

Malicious code in victoria-wallet-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 305ff7c4db9d9046f3637aeb746d2f95c58e1083e6fd8cfecf220f9a20911162 The package victoria-wallet-validator was found to contain malicious code. Source: ghsa-malware...

Malicious code in sa-company-registration-number-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f15485422c9807206afeb3c43ed1e03d2f2499b0c689d8bf253e663cf72d7fa7 The package sa-company-registration-number-regex was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/php-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81619d0ddfa1696b71c550ba94be4ddbdaed53aaef37376f8024945422da51b5 The package @asyncapi/php-template was found to contain malicious code. Source: ghsa-malware...

Malicious code in @actbase/node-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0017bb31e0f352229b8a7afc7305701c64b60033a69ccfec390385c507c6d85 The package @actbase/node-server was found to contain malicious code. Source: ghsa-malware...

Malicious code in @trigo/jsdt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff5aae2e5762514a4d2a304a2ceb36d9b895c8bd88c9a6303752aea4b078119f The package @trigo/jsdt was found to contain malicious code. Source: ghsa-malware 91f1b0ba55c42b887eade435580838bef529a7fe7a9b9fd8b3cd05ada0528cc7 An...

Malicious code in @asyncapi/specs (npm)

@asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2 were published as part of the "Miasma RAT" software supply-chain attack campaign identifier "miasma-train-p1" that compromised several widely used @asyncapi npm packages on 2026-07-14. Unlike the whitespace-hiding technique used in the compromise...

MAL-2025-190555 Malicious code in tailwindcss-webfont-awesome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37cc31540e459bb02a97d3d2ce96eecdcff72b1c3e07f0e875540b68ba48a60 The package tailwindcss-webfont-awesome was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190512 Malicious code in bcryptkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a480449fe3e91f066e60e8f4ed7d4c85e6915b3c9b2712769c54eac67eefa452 The package bcryptkit was found to contain malicious code. Source: ghsa-malware fabc375d7ac31af2156e2d4ecf33d4e87df80d7b95873af883a10d9c35dfabb9 Any...