Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm Registry

Cybersecurity researchers have disclosed details of what appears to be a new strain of Shai Hulud on the npm registry with slight modifications from the previous wave observed last month. The npm package that embeds the novel Shai Hulud strain is "@vietmoney/react-big-calendar," which was uploade...

EUVD-2025-205930

Malicious code in @vietmoney/vision-camera-code-scanner npm...

EUVD-2025-205927

Malicious code in @vietmoney/react-native-vnpay-merchant npm...

Malicious code in @vietmoney/react-native-smart-gallery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdecb4163903c7cab6a325ea865641719253be69a34f76a172a717792a8b53bb The package @vietmoney/react-native-smart-gallery was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview @vietmoney/react-big-calendar is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @vietmoney/react-native-image-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5d6e41bb857d4ed96776b54551e25a97efccd98d763659d945f9c969c7981cf The package @vietmoney/react-native-image-transformer was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-205929

Malicious code in @vietmoney/react-big-calendar npm...

EUVD-2025-205928

Malicious code in @vietmoney/react-native-smart-gallery npm...

Malicious Package

Overview @vietmoney/react-native-smart-page is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

EUVD-2025-205932

Malicious code in @vietmoney/react-native-tags-input npm...

EUVD-2025-205933

Malicious code in @vietmoney/react-native-smart-page npm...

Malicious code in @vietmoney/react-native-vnpay-merchant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db7aa9187bf0ea16a7e5209406b93cd1b253b087a17bac46ad5cf79b8fa317f3 The package @vietmoney/react-native-vnpay-merchant was found to contain malicious code. Source: ghsa-malware...

Malicious code in @vietmoney/vision-camera-code-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e01bd6cc2d11eb6ddf080b713c76d97cd699ee78c903b01d3ef95fb2fc23356 The package @vietmoney/vision-camera-code-scanner was found to contain malicious code. Source: ghsa-malware...

Malicious code in @vietmoney/react-native-true-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96077b211aad35cef450b272ea27d6ef00276ecef718afa31ecb225b43d0b60e The package @vietmoney/react-native-true-id was found to contain malicious code. Source: ghsa-malware...

@vietmoney/react-native-smart-gallery (1.2.2) potentially affected by unknown CVE via @vietmoney/react-native-smart-page (1.1.2)

@vietmoney/react-native-smart-page NPM version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @vietmoney/react-native-smart-page and may be impacted: - @vietmoney/react-native-smart-gallery 1.2.2 Source cves: unknown CVE Source advisory:...

MAL-2025-192997 Malicious code in @vietmoney/react-native-image-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5d6e41bb857d4ed96776b54551e25a97efccd98d763659d945f9c969c7981cf The package @vietmoney/react-native-image-transformer was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192994 Malicious code in @vietmoney/react-big-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b38aebebed4a38e2464d8abb76fbda4a16d4cf03b372124ec3d069c63f6e79f2 The package @vietmoney/react-big-calendar was found to contain malicious code. Source: ghsa-malware...

MAL-2025-193002 Malicious code in @vietmoney/react-native-vnpay-merchant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db7aa9187bf0ea16a7e5209406b93cd1b253b087a17bac46ad5cf79b8fa317f3 The package @vietmoney/react-native-vnpay-merchant was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192996 Malicious code in @vietmoney/react-native-htmlview (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82606664e32d7050a729171d5dac24f54950e90b7259a7f90a582e94632fcc61 The package @vietmoney/react-native-htmlview was found to contain malicious code. Source: ghsa-malware...

MAL-2025-193001 Malicious code in @vietmoney/react-native-true-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96077b211aad35cef450b272ea27d6ef00276ecef718afa31ecb225b43d0b60e The package @vietmoney/react-native-true-id was found to contain malicious code. Source: ghsa-malware...