Malicious Package,Malicious Code

ua-parser-js >=1.0.0 <1.0.1,>=0.8.0 <0.8.1,>=0.7.29 <0.7.30

https://snyk.io/vuln/SNYK-JS-UAPARSERJS-1766952
https://www.bleepingcomputer.com/news/security/popular-npm-library-hijacked-to-install-password-stealers-miners/
https://github.com/advisories/GHSA-pjwm-rvh2-c87w

https://twitter.com/npmjs/status/1456310581846163457
coa, rc

https://security.snyk.io/vuln/SNYK-JS-XVIDEOSALERTS-1920929
https://security.snyk.io/vuln/SNYK-JS-PORNHUBALERTS-1920927
https://twitter.com/Checkmarx/status/1458191508167749635

https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/

https://developers-jp.googleblog.com/2021/11/protect-opensource.html

https://brutalgoblin.hatenablog.jp/entry/2021/11/27/182601

https://jfrog.com/blog/malicious-npm-packages-are-after-your-discord-tokens-17-new-packages-disclosed/

https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-with-over-10-000-downloads-taken-down/

https://docs.illustria.io/blog/typosquatting-momnet/?fbclid=IwAR3EiycBKHUtYuycB7UfAu7Ej932-VLOjOWApz7Ev364mWrLP9z9CkcEeE4
https://security.snyk.io/vuln/SNYK-JS-MOMNET-2324797

colors.js

https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

https://gist.github.com/azu/32e2eaca5b85d9176b7be6d4f99b5cdf

https://snyk.io/blog/open-source-npm-packages-colors-faker/

https://zenn.dev/azu/articles/d56615b2e11ad1

https://blog.sonatype.com/pypi-flooded-with-over-1200-dependency-confusion-packages

https://thehackernews.com/2022/02/25-malicious-javascript-libraries.html

https://securityboulevard.com/2022/02/malicious-roblox-cookie-and-discord-token-stealers-hit-pypi-repository/

https://thehackernews.com/2021/07/several-malicious-typosquatted-python.html

https://twitter.com/azu_re/status/1503896530302148608

https://blog.sonatype.com/remember-npm-library-colors-theres-no-such-thing-as-colors-2.0

https://blog.sonatype.com/this-week-in-malware-400-npm-packages-target-azure-uber-airbnb-developers

https://blog.sonatype.com/this-week-in-malware-a-fix-crash-info-stealer-and-500-malicious-npm-packages

https://www.bleepingcomputer.com/news/security/rise-in-npm-protestware-another-open-source-dev-calls-russia-out/

https://blog.rust-lang.org/2022/05/10/malicious-crate-rustdecimal.html

https://www.itmedia.co.jp/news/articles/2301/03/news033.html

https://blog.sandworm.dev/one-in-two-new-npm-packages-is-seo-spam-right-now

https://news.mynavi.jp/techplus/article/20230518-2681629/