@voiceflow/natural-language-commander
MAL-2025-191356
npmmalware11/25/2025
Description
Malicious code in @voiceflow/natural-language-commander (npm)
Indicators of Compromise
SHA256 Hashes (3)
c36ff4b9d85a8936abeb34dfa4ccdb4371d59602d32c7e59a2a210dccee485a2
e8749cf076a2f41ebb0f9c63659b21196586da1eca7a3a5067ef0d45918390fc
bcffcb39c546d02117506c26844a1fddcedc61f18cd934b27642817c62189437
References (4)
https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomainsOSVhttps://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attackOSVhttps://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromisedOSVhttps://github.com/advisories/GHSA-4xjf-wwjc-fmhvOSV
Details
Ecosystemnpm
Attack Typemalware
Published11/25/2025
Aliases
GHSA-4xjf-wwjc-fmhv
Quick Actions