MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

GHSA-8G2R-HHVJ-MV99 vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventstore, tekton-chains, k8ssandra-client, k8s-device-plugin, tekton-pipelines, cert-manager, argo-cd, litestream, xeol, spark-operator, cortex, trino, k3s, rabbitmq-cluster-operator, libnvidia-container, rancher-webhook, timestamp-authority, paranoia...

MAL-2025-141472 Malicious code in dagda-hydra-centaurus-hexo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 605b352e297554fe9236e9e8e02de5c22194bdced5da448b3c8ffe0d6a8e855a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in universal-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eed1b9a3e44988da8116d705cc34007be044ced2eabd676d6cd714642e59ded6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...