PRIMARY-SOURCE REVIEW · 2026-11-03T16:20:00+09:00

npm: 92 malicious-package advisories; check affected releases

The publication window contains 92 npm malware advisories. This counts advisories, not machines or compromises. The table preserves package names and affected ranges from the original API; an unlisted first fix is not replaced with an assumed safe release.

What to check

Check installation and execution history, lockfiles and distributed images. Isolate affected environments and revoke and reissue keys from a separate clean environment. Removal alone does not establish that persistence is gone; rebuild and investigate logs.

A first fixed version is listed only when the advisory provides one. Advisory counts are not incident counts.

Affected and fixed versions by advisory (92)

GHSA-45rq-6v9r-4475

Malware in luna-baileys

luna-baileys (npm): affected = 0.0.0-stage → fixed No fixed version listed
luna-baileys (npm): affected = 1.0.0 → fixed No fixed version listed
luna-baileys (npm): affected = 9.0.24 → fixed No fixed version listed
luna-baileys (npm): affected = 9.0.25 → fixed No fixed version listed
luna-baileys (npm): affected = 9.0.26 → fixed No fixed version listed
luna-baileys (npm): affected = 9.0.27 → fixed No fixed version listed
luna-baileys (npm): affected = 9.0.28 → fixed No fixed version listed
luna-baileys (npm): affected = 9.0.33 → fixed No fixed version listed

GHSA-726f-wf9g-5893

Malicious code in @goparrot-dashboard/store (npm)

@goparrot-dashboard/store (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-gj25-xrmw-6297

Malicious code in @goparrot-dashboard/promotion (npm)

@goparrot-dashboard/promotion (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-39ch-q3p3-3j33

Malicious code in @atedone/workspace-context (npm)

@atedone/workspace-context (npm): affected = 0.0.23 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.14 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.25 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.22 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.20 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.15 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.19 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.13 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.12 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.18 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.21 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.24 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.16 → fixed No fixed version listed
@atedone/workspace-context (npm): affected = 0.0.17 → fixed No fixed version listed

GHSA-72x7-67fx-v24p

Malicious code in @goparrot-dashboard/homepages (npm)

@goparrot-dashboard/homepages (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-3hj7-wfw3-jm84

Malicious code in @goparrot-dashboard/franchise-management (npm)

@goparrot-dashboard/franchise-management (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-fc2g-x424-gvq4

Malicious code in @goparrot-dashboard/order (npm)

@goparrot-dashboard/order (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-332r-cpwr-xr6h

Malicious code in @goparrot-dashboard/marketing (npm)

@goparrot-dashboard/marketing (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-w544-4xh4-3m6v

Malicious code in @corexium/xbails (npm)

@corexium/xbails (npm): affected = 0.0.7 → fixed No fixed version listed

GHSA-q8c5-hxhq-jprv

Malicious code in @goparrot-dashboard/settings (npm)

@goparrot-dashboard/settings (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-89qx-w49w-4q48

Malicious code in @goparrot-dashboard/franchise-menu-settings (npm)

@goparrot-dashboard/franchise-menu-settings (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-rg85-7qj4-rpcw

Malicious code in @goparrot-dashboard/payment (npm)

@goparrot-dashboard/payment (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-q7mj-99p7-8363

Malicious code in @goparrot-dashboard/i18n (npm)

@goparrot-dashboard/i18n (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-23g9-rf8p-3cj3

Malicious code in @goparrot-dashboard/combos (npm)

@goparrot-dashboard/combos (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-cw3v-7hh4-m39w

Malicious code in @goparrot-dashboard/loyalty (npm)

@goparrot-dashboard/loyalty (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-7j98-hxg2-v7pj

Malicious code in @goparrot-dashboard/menu (npm)

@goparrot-dashboard/menu (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-8g27-6w2c-r34p

Malicious code in @goparrot-dashboard/franchise-directory (npm)

@goparrot-dashboard/franchise-directory (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-jchc-cxq2-2rx9

Malicious code in @goparrot-dashboard/franchise-marketing (npm)

@goparrot-dashboard/franchise-marketing (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-mp83-rh86-7fmp

Malicious code in @goparrot-dashboard/app (npm)

@goparrot-dashboard/app (npm): affected = 0.0.2 → fixed No fixed version listed
@goparrot-dashboard/app (npm): affected = 0.0.1 → fixed No fixed version listed
@goparrot-dashboard/app (npm): affected = 0.0.3 → fixed No fixed version listed

GHSA-5m6m-8mwq-grp4

Malicious code in @goparrot-dashboard-api/store (npm)

@goparrot-dashboard-api/store (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-r6m4-fv3j-rm7v

Malicious code in @goparrot-dashboard/auth (npm)

@goparrot-dashboard/auth (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-x9q7-g8cr-vw76

Malicious code in @goparrot-dashboard/analytics (npm)

@goparrot-dashboard/analytics (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-6668-jgqr-p263

Malicious code in @goparrot-dashboard-api/role-v2 (npm)

@goparrot-dashboard-api/role-v2 (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-4fj7-5c6w-cmvh

Malicious code in @goparrot-dashboard-api/shared (npm)

@goparrot-dashboard-api/shared (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-g76x-w4rw-x5j8

Malicious code in @goparrot-dashboard/category (npm)

@goparrot-dashboard/category (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-g4rr-4xhm-6q58

Malicious code in @goparrot-dashboard-api/users (npm)

@goparrot-dashboard-api/users (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-3vmc-mjw2-cmrq

Malicious code in @goparrot-dashboard/combo-group (npm)

@goparrot-dashboard/combo-group (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-78j7-7qrc-2j38

Malicious code in @goparrot-dashboard-api/orchestration (npm)

@goparrot-dashboard-api/orchestration (npm): affected = 0.0.1 → fixed No fixed version listed

GHSA-vwm6-r9cc-qg37

Malware in paidwithtab

paidwithtab (npm): affected = 3.0.0 → fixed No fixed version listed

GHSA-hvpp-rx4h-crg5

Malware in scdn-jquery

scdn-jquery (npm): affected >= 0 → fixed No fixed version listed

GHSA-4h5p-w547-9qmv

Malicious code in @ifasn/mmdd-doc-mcp (npm)

@ifasn/mmdd-doc-mcp (npm): affected = 1.1.1 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.0.6 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.0.3 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.0.4 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.1.6 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.0.4-2 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.1.8 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 2.0.1 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.0.1 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.0.5 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.1.3 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.1.7 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.1.9-2 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 2.0.4 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.1.0 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.1.2 → fixed No fixed version listed
@ifasn/mmdd-doc-mcp (npm): affected = 1.1.5 → fixed No fixed version listed

GHSA-f826-46h5-5rcq

Malicious code in @ifasn/mmd-doc-mcp (npm)

@ifasn/mmd-doc-mcp (npm): affected = 1.0.0 → fixed No fixed version listed
@ifasn/mmd-doc-mcp (npm): affected = 1.0.2 → fixed No fixed version listed

GHSA-4q9j-4rv8-jp32

Malicious code in @ifasn/mdd-doc-mcp (npm)

@ifasn/mdd-doc-mcp (npm): affected = 1.0.7 → fixed No fixed version listed
@ifasn/mdd-doc-mcp (npm): affected = 1.0.8 → fixed No fixed version listed
@ifasn/mdd-doc-mcp (npm): affected = 2.0.6 → fixed No fixed version listed

GHSA-rvw8-22w3-342v

Malicious code in @ifasn/md-doc-mcp (npm)

@ifasn/md-doc-mcp (npm): affected = 1.0.5 → fixed No fixed version listed
@ifasn/md-doc-mcp (npm): affected = 1.0.3 → fixed No fixed version listed
@ifasn/md-doc-mcp (npm): affected = 1.0.4 → fixed No fixed version listed

GHSA-pg3x-mr83-5crv

Malware in bfvkjmeikpwhqxc

bfvkjmeikpwhqxc (npm): affected = 0.0.0-stage → fixed No fixed version listed
bfvkjmeikpwhqxc (npm): affected = 1.0.1 → fixed No fixed version listed
bfvkjmeikpwhqxc (npm): affected = 1.0.0 → fixed No fixed version listed

GHSA-whfc-859g-h5j3

Malware in internal-renderers

internal-renderers (npm): affected >= 0 → fixed No fixed version listed

GHSA-m4h2-gmhc-mhcp

Malware in pandafortunerush

pandafortunerush (npm): affected >= 0 → fixed No fixed version listed

GHSA-q7rp-q644-j8rp

Malware in ms-client-portal

ms-client-portal (npm): affected >= 0 → fixed No fixed version listed

GHSA-x8mc-7393-54vr

Malware in @levvicode/eslint-config

@levvicode/eslint-config (npm): affected >= 0 → fixed No fixed version listed

GHSA-93rf-36fj-m7gp

Malware in justinofficial

justinofficial (npm): affected >= 0 → fixed No fixed version listed

GHSA-g4x3-g43p-pwrw

Malware in @maulenv/baileys

@maulenv/baileys (npm): affected >= 0 → fixed No fixed version listed

GHSA-cjqv-xvjx-m5q5

Malware in nachles

nachles (npm): affected >= 0 → fixed No fixed version listed

GHSA-84hg-5759-2cgg

Malware in levvleys

levvleys (npm): affected >= 0 → fixed No fixed version listed

GHSA-52vf-f48x-82m5

Malware in @levvicode/baileys

@levvicode/baileys (npm): affected >= 0 → fixed No fixed version listed

GHSA-gqvq-9m83-c527

Malware in aytidaoffc

aytidaoffc (npm): affected >= 0 → fixed No fixed version listed

GHSA-wcx4-q6jx-3vhj

Malware in @levvicode/libsignal-node

@levvicode/libsignal-node (npm): affected >= 0 → fixed No fixed version listed

GHSA-rqhx-p7qj-qqc8

Malware in tailwind-animate-engine

tailwind-animate-engine (npm): affected >= 0 → fixed No fixed version listed

GHSA-rfxc-3373-jvfq

Malware in tailwind-animatrix

tailwind-animatrix (npm): affected >= 0 → fixed No fixed version listed

GHSA-4hf4-p92p-5m6c

Malware in tailwind-animate-final

tailwind-animate-final (npm): affected >= 0 → fixed No fixed version listed

GHSA-vpvh-94mq-8h4j

Malware in tailwind-animate-test

tailwind-animate-test (npm): affected >= 0 → fixed No fixed version listed

GHSA-89v8-j949-j3h5

Malware in unjailed

unjailed (npm): affected >= 0 → fixed No fixed version listed

GHSA-2g3q-xxv2-vh4p

Malware in @mrlegendbot/libsignal-node

@mrlegendbot/libsignal-node (npm): affected >= 0 → fixed No fixed version listed

GHSA-g94h-cm42-jgx8

Malware in @mrlegendbot/baileys

@mrlegendbot/baileys (npm): affected >= 0 → fixed No fixed version listed

GHSA-9h7q-53gw-grwc

Malware in wallet-adapter-base

wallet-adapter-base (npm): affected >= 0 → fixed No fixed version listed

GHSA-43pw-v6x2-9gh4

Malware in sol-wallet-adapter

sol-wallet-adapter (npm): affected >= 0 → fixed No fixed version listed

GHSA-r55f-fj5f-qxf9

Malware in contracts-upgradeable

contracts-upgradeable (npm): affected >= 0 → fixed No fixed version listed

GHSA-gmrr-hqfh-q4j3

Malware in calculator-preinstall-chain-demo

calculator-preinstall-chain-demo (npm): affected >= 0 → fixed No fixed version listed

GHSA-8cf8-9j3v-99g4

Malware in axelarjs-sdk

axelarjs-sdk (npm): affected >= 0 → fixed No fixed version listed

GHSA-fr4c-gqv9-5rgx

Malware in @bigdevin55/calculator-install-demo

@bigdevin55/calculator-install-demo (npm): affected >= 0 → fixed No fixed version listed

GHSA-v4v4-v74v-86vq

Malware in @bigdevin55/calculator-install-hook

@bigdevin55/calculator-install-hook (npm): affected >= 0 → fixed No fixed version listed

GHSA-c6pj-8fr8-qq3c

Malware in calculator-preinstall-hook-demo

calculator-preinstall-hook-demo (npm): affected >= 0 → fixed No fixed version listed

GHSA-mv5j-phwp-534j

Malware in @nuxzofficial/baileys

@nuxzofficial/baileys (npm): affected >= 0 → fixed No fixed version listed

GHSA-8967-3p4r-vpwp

Malware in nuxzofficial

nuxzofficial (npm): affected >= 0 → fixed No fixed version listed

GHSA-4q2f-q5qq-w9cm

Malware in tailwindcss-animate-bridge

tailwindcss-animate-bridge (npm): affected >= 0 → fixed No fixed version listed

GHSA-cv4q-j2g9-xp9h

Malware in @utilitycraft/tailwindcss-motion-atelier

@utilitycraft/tailwindcss-motion-atelier (npm): affected >= 0 → fixed No fixed version listed

GHSA-frgx-cf5w-vxr5

Malware in atlassian-wallboard-plugin1

atlassian-wallboard-plugin1 (npm): affected >= 0 → fixed No fixed version listed

GHSA-m4gq-5vx2-5x8c

Malware in atlassian-wallboard-plugin

atlassian-wallboard-plugin (npm): affected >= 0 → fixed No fixed version listed

GHSA-p5qq-93vh-5c8h

Malware in claims-ac1

claims-ac1 (npm): affected >= 0 → fixed No fixed version listed

GHSA-2v69-q2gc-qm5j

Malware in persona-ai-sdk

persona-ai-sdk (npm): affected = 1.0.0 → fixed No fixed version listed

GHSA-8cq9-2c2q-58ww

Malicious code in @notrainer/nobtrainer-sdk (npm)

@notrainer/nobtrainer-sdk (npm): affected > 0 → fixed No fixed version listed
@notrainer/nobtrainer-sdk (npm): affected = 1.0.2 → fixed No fixed version listed
@notrainer/nobtrainer-sdk (npm): affected = 1.0.3 → fixed No fixed version listed
@notrainer/nobtrainer-sdk (npm): affected = 1.0.4 → fixed No fixed version listed
@notrainer/nobtrainer-sdk (npm): affected = 1.0.5 → fixed No fixed version listed

GHSA-354j-r6m9-986p

Malicious code in self-v8 (npm)

self-v8 (npm): affected > 0 → fixed No fixed version listed
self-v8 (npm): affected = 1.0.0 → fixed No fixed version listed
self-v8 (npm): affected = 2.1.8 → fixed No fixed version listed
self-v8 (npm): affected = 2.1.9 → fixed No fixed version listed
self-v8 (npm): affected = 8.1.9 → fixed No fixed version listed
self-v8 (npm): affected = 8.3.9 → fixed No fixed version listed
self-v8 (npm): affected = 8.5.9 → fixed No fixed version listed
self-v8 (npm): affected = 8.7.9 → fixed No fixed version listed
self-v8 (npm): affected = 8.9.9 → fixed No fixed version listed

GHSA-9jxw-2pvm-5q9f

Malicious code in litecore-lib-ltc (npm)

litecore-lib-ltc (npm): affected > 0 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.0.0 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.3 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.4 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.5 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.6 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.7 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.8 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.9 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.10 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.11 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.12 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.13 → fixed No fixed version listed
litecore-lib-ltc (npm): affected = 1.9.14 → fixed No fixed version listed

GHSA-q54x-hhg5-963x

Malicious code in @mobile-platform/magnetic-components (npm)

@mobile-platform/magnetic-components (npm): affected = 0.0.1 → fixed No fixed version listed
@mobile-platform/magnetic-components (npm): affected = 0.0.2 → fixed No fixed version listed
@mobile-platform/magnetic-components (npm): affected = 0.0.3 → fixed No fixed version listed

GHSA-v7f8-27g9-qx88

Malicious code in contracts-upgradeable (npm)

contracts-upgradeable (npm): affected = 1.0.0 → fixed No fixed version listed

GHSA-543q-wq5f-hmgh

Malicious code in scdn-jquery (npm)

scdn-jquery (npm): affected = 0.1.6 → fixed No fixed version listed

GHSA-j2hf-rv9p-8jvr

Malicious code in bigbob22-test (npm)

bigbob22-test (npm): affected = 1.0.0 → fixed No fixed version listed

GHSA-q9p6-j8q4-8qh9

Malicious code in ms-client-portal (npm)

ms-client-portal (npm): affected = 1.0.0 → fixed No fixed version listed
ms-client-portal (npm): affected = 10.0.0 → fixed No fixed version listed

GHSA-pw4j-9v86-8c3g

Malicious code in cutekitten-test (npm)

cutekitten-test (npm): affected = 1.0.1 → fixed No fixed version listed

GHSA-r89f-jjgp-3q97

Malicious code in wallet-adapter-base (npm)

wallet-adapter-base (npm): affected = 1.0.0 → fixed No fixed version listed

GHSA-w48h-24q2-rjqx

Malicious code in @johnruff215-dev/solana-wallet-tracker (npm)

@johnruff215-dev/solana-wallet-tracker (npm): affected > 0 → fixed No fixed version listed
@johnruff215-dev/solana-wallet-tracker (npm): affected = 1.0.0 → fixed No fixed version listed
@johnruff215-dev/solana-wallet-tracker (npm): affected = 1.0.1 → fixed No fixed version listed

GHSA-xpgj-8rc5-pq44

Malicious code in zystcdemo (npm)

zystcdemo (npm): affected = 1.0.0 → fixed No fixed version listed

GHSA-p373-68vj-fvrh

Malicious code in calculator-preinstall-hook-demo (npm)

calculator-preinstall-hook-demo (npm): affected = 1.1.2 → fixed No fixed version listed

GHSA-3x3m-5j3w-83rj

Malicious code in claims-ac1 (npm)

claims-ac1 (npm): affected = 1.0.0 → fixed No fixed version listed

GHSA-j62h-2r3r-ggh9

Malicious code in sol-wallet-adapter (npm)

sol-wallet-adapter (npm): affected = 1.0.0 → fixed No fixed version listed
sol-wallet-adapter (npm): affected = 1.0.1 → fixed No fixed version listed
sol-wallet-adapter (npm): affected = 1.0.7 → fixed No fixed version listed

GHSA-69w5-x7cm-v78h

Malicious code in axelarjs-sdk (npm)

axelarjs-sdk (npm): affected = 1.0.1 → fixed No fixed version listed

GHSA-v764-465v-vh59

Malicious code in dependencykfee-2 (npm)

dependencykfee-2 (npm): affected = 1.0.0 → fixed No fixed version listed

GHSA-5mwr-h84x-47h6

Malicious code in calculator-preinstall-chain-demo (npm)

calculator-preinstall-chain-demo (npm): affected = 1.1.2 → fixed No fixed version listed
calculator-preinstall-chain-demo (npm): affected = 1.1.1 → fixed No fixed version listed