MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: govulncheck, k8s-device-plugin, mesosphere-vsphere-csi, cert-manager-csi-driver, sftpgo-plugin-eventstore, datadog-agent, argo-workflows, kots, scorecard, ko, libnvidia-container, cert-manager, rabbitmq-cluster-operator, jitsucom-bulker, slsa-verifier, kaf,...

MAL-2025-141472 Malicious code in dagda-hydra-centaurus-hexo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 605b352e297554fe9236e9e8e02de5c22194bdced5da448b3c8ffe0d6a8e855a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in universal-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eed1b9a3e44988da8116d705cc34007be044ced2eabd676d6cd714642e59ded6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...