@tarojs/cli-convertor (4.1.12-beta.47), @tarojs/create-app (4.1.12-beta.47) potentially affected by unknown CVE via @tarojs/cli (4.1.12-beta.47)

@tarojs/cli NPM version 4.1.12-beta.47 is affected by a known vulnerability. The following packages have a transitive dependency on @tarojs/cli and may be impacted: - @tarojs/cli-convertor 4.1.12-beta.47 - @tarojs/create-app 4.1.12-beta.47 Source cves: unknown CVE Source advisory:...

@tarojs/cli-convertor (4.2.1-beta.0), @tarojs/create-app (4.2.1-beta.0) potentially affected by unknown CVE via @tarojs/cli (4.2.1-beta.0)

@tarojs/cli NPM version 4.2.1-beta.0 is affected by a known vulnerability. The following packages have a transitive dependency on @tarojs/cli and may be impacted: - @tarojs/cli-convertor 4.2.1-beta.0 - @tarojs/create-app 4.2.1-beta.0 Source cves: unknown CVE Source advisory:...

Malicious code in @tarojs/cli (npm)

Source: amazon-inspector 59b4e6cd0fe6bd16c6fb2bd04e6542a2a3052182d8815a08b124df56f2d9fde2 On npm install, the package's postinstall script performs a reachability GET to https://taro.jd.com/ and, on success, invokes the package's own bin/taro global-config add-plugin...

MAL-2026-4453 Malicious code in @tarojs/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b4e6cd0fe6bd16c6fb2bd04e6542a2a3052182d8815a08b124df56f2d9fde2 On npm install, the package's postinstall script performs a reachability GET to https://taro.jd.com/ and, on success, invokes the package's own...