6885 matches found
Malicious code in matrixflow-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45393245d9a2fca558d1bcb8b7c9d5263c16ff63e9a038a51169b720c85e1352 [email protected] is a typosquat/repackage of ml-matrix the UMD global is mlMatrix; homepage matrixflow-js.github.io does not correspond to the rea...
MAL-2026-14272 Malicious code in price-scripping-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...
Malicious code in price-scripping-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...
MAL-2026-14247 Malicious code in magika-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41cd28e41bc842fd046a2bff254f450edd0b6d2d15d961fe768cf5e9ebfa197f magika-js is a typosquat of Google's magika library. The postinstall lifecycle script collects installer host identifiers hostname, platform, arch,...
Malicious code in @sarex-team/sdk-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...
MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...
Malicious code in core-js-gns (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631 The package's postinstall hook package.json → node init.js runs an installer-side dropper. init.js gates on developer-machine heuristics presence of...
MAL-2026-14175 Malicious code in core-js-gns (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631 The package's postinstall hook package.json → node init.js runs an installer-side dropper. init.js gates on developer-machine heuristics presence of...
CVE-2026-55085: Improper Neutralization of Input During Web Page Generation
Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...
CVE-2026-63640
creationtimestamp| type| source ---|---|--- 2026-08-18 20:35:11+00:00| published-proof-of-concept| https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-q4gh-4ffp-5cg8...
CVE-2026-18504
fastify versions before 5.12.1 suffer a schema validation bypass: when a route schema targets a root primitive (e.g., integer), Ajv coerces the input type but Fastify passes the original uncoerced value to handlers, letting invalid data reach application logic. Upgrade to 5.12.1; no workarounds e...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.29 security and extras update
Red Hat OpenShift Container Platform release 4.21.29 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.34 security and extras update
Red Hat OpenShift Container Platform release 4.20.34 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.10 security and extras update
Red Hat OpenShift Container Platform release 4.22.10 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...
CVE-2026-63640: Exposure of Sensitive Information to an Unauthorized Actor
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...
CVE-2026-63641: Improper Access Control
MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks...
ROOT-APP-NPM-CVE-2023-46233 CVE-2023-46233 in crypto-js - Patched by Root
Root has patched CVE-2023-46233 in the crypto-js package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-71851 CVE-2026-71851 in crypto-js - Patched by Root
Root has patched CVE-2026-71851 in the crypto-js package for Root:npm. Multiple fixed versions available...