MAL-2025-190871

    Dashboard / Malicious Package / MAL-2025-190871

    MAL-2025-190871

    Published: 24 Nov 2025Last Modified: 23 Dec 2025

    Summary: Malicious code in @mparpaillon/imagesloaded (npm)

    Details: Source: amazon-inspector (733f9cddc9163f876de6db1b1dab8c6325aa55f34f478662321875c52f242ea4) The package @mparpaillon/imagesloaded was found to contain malicious code.

    References: https://www.mend.io/blog/shai-hulud-the-second-coming, https://checkmarx.com/zero-post/shai-huluds-second-coming-npm-malware-attack-evolved, https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains, https://www.veracode.com/blog/return-of-the-shai-hulud-worm, https://www.reversinglabs.com/blog/another-shai-hulud-npm-worm-is-spreading-heres-what-you-need-to-know

    Affected packages

    Package

    Name: @mparpaillon/imagesloaded

    Purl: pkg:npm/%40mparpaillon/imagesloaded

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    4.1.2
    MAL-2025-190871 | CVE-DB