MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb59d96acba76c5d5e2044eae3d7dfeb33bc19f10d75aa04fcf6765ad9b7fde8 Package @public-for-cdao/[email protected] is a dependency-confusion payload targeting an internal @cdao/token scope. package.json declares a postinstal...

GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: cortex, grafana-operator, metrics-server, cloudnative-pg, helm, skopeo, helm-operator, minio, sftpgo-plugin-auth, migrate, pdfcpu, prometheus-blackbox-exporter, nfpm, nri-apache, cert-manager-csi-driver, lazydocker, consul-k8s, aactl, local-static-provisioner,...

MAL-2025-141472 Malicious code in dagda-hydra-centaurus-hexo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 605b352e297554fe9236e9e8e02de5c22194bdced5da448b3c8ffe0d6a8e855a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in universal-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eed1b9a3e44988da8116d705cc34007be044ced2eabd676d6cd714642e59ded6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...