MAL-2026-17507 Malicious code in hardhat-jsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62ac44be2745338b73861690e7f979216fdfc6c3797dfa2f450e9063aa4158d1 The package is published as 'hardhat-jsx' but its metadata, documentation, and lib/ layout impersonate the pino logger keywords...

MAL-2026-13356 Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

Malicious code in chai-foundry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e40493af5310c6ee769911bff65e55538911ae3f286fba2a3474f9f8a38940 [email protected] is a trojan package presenting itself as a chai plugin README shows chai.usechaiLeaf while its badges, documentation, and internal...

Malicious code in hamus.js (npm)

npm/hamus.js version 0.4.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

MAL-2026-11705 Malicious code in @or-sdk/knowledge-models (npm)

npm/@or-sdk/knowledge-models is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @cacheable/net (npm)

npm/@cacheable/net version 2.1.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-11558 Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in itale-adci-gnyagyyu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4d75141209655c4d7f19debd59e89cdadca5ed3f04e6e097666e81243b627d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SUSE CVE-2017-9333

OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, when the URL refers to an attacker-controlled web site with a Trojan horse package. This has security implications in cases where untrusted users can trigger...