MAL-2026-11533 Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

Malicious code in @zzzgenesis00/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ad59aa1c004d723d6e24f8113d8f3d45728c0b26fc41531ec00c0f91d2ddef The package impersonates XRPLF's xrp-lib author metadata and homepage point at github.com/XRPLF/xrp-lib while being published under an unrelated scop...

Malicious code in simple-date-formatter-util-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c4633742f36d29ca968a2ce71c97cb81e9cb2d2c76738742bb39de671cb115 Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launches a backgrounded interactiv...

MAL-2026-11544 Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...

Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...

Malicious code in discord-vibegrations-api-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6 The package declares a postinstall lifecycle hook postinstall: node postinstall.js that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to...

MAL-2026-11537 Malicious code in discord-vibegrations-api-natives (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cb64ecc29aa68ec4659bab280f4ffd2c3de889cc966c0974f85b0c488edc603 On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes into the stdin of a spawned s...

MAL-2026-11543 Malicious code in simple-date-formatter-new-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall shell one-liner that, on n...

MAL-2026-11525 Malicious code in nagix-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...

Malicious code in nagix-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...

Authorization Bypass Through User-Controlled Key

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the GraphQL node's Authentication parameter, which accepts expression values and, when several credentials of different types are attached in...

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

CVE-2026-70477

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed...

CVE-2026-69264

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

MAL-2026-11953 Malicious code in @umacloud/cli-darwin-arm64 (npm)

npm/@umacloud/cli-darwin-arm64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @umacloud/cli-linux-musl-x64 (npm)

npm/@umacloud/cli-linux-musl-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11551 Malicious code in @adminide-stack/clock-tik-browser (npm)

npm/@adminide-stack/clock-tik-browser is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

Malicious code in @deliveroo/reevent (npm)

npm/@deliveroo/reevent is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in umadev (npm)

npm/umadev is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the worm...

Malicious code in @umacloud/cli-darwin-x64 (npm)

npm/@umacloud/cli-darwin-x64 is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...