See the full list of npm packages compromised in the "SHA1-Hulud npm supply chain incident – Nov 2025" [View compromised packages].
remark-emoticons vulnerabilities
This [remark][remark] plugin parses ASCII emoticons such as `:D` or shortcodes such as `:smiling-cat:`. It can be configured to parse any shortcode/emoticon you wish.