@angular-architects/build-angular (16.2.0-next.2), @angular-builders/custom-esbuild (>=17.1.0-beta.0, <=19.1.0) +170 more potentially affected by CVE-2026-102992 via piscina (>=4.0.0, <=4.9.3)

piscina NPM version =4.0.0, =17.1.0-beta.0, =16.0.0-beta.0, =18.2.6-RC-1, =16.0.0, =16.2.0-next.0, =18.0.0-next.3, =2.2.7-bb.6, =2.1.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.17-dev.40 and more Source cves: CVE-2026-102992 Source advisory: SNYK:JS-PISCINA-20417213...

@angular-architects/build-angular (16.2.0-next.2), @angular-builders/custom-esbuild (>=17.1.0-beta.0, <=19.1.0) +170 more potentially affected by CVE-2026-102992 via piscina (>=4.0.0, <=4.9.3)

piscina NPM version =4.0.0, =17.1.0-beta.0, =16.0.0-beta.0, =18.2.6-RC-1, =16.0.0, =16.2.0-next.0, =18.0.0-next.3, =2.2.7-bb.6, =2.1.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.17-dev.40 and more Source cves: CVE-2026-102992 Source advisory: GHSA-67C8-PQHQ-4RMX...

Malicious Package

Overview @angulardevkit/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @angulardevkit/architect is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.8.3) +1 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=4.0.0, <=4.1.0)

http-proxy-middleware NPM version =4.0.0, =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55603 Source advisory: MEND:CVE-2026-55603...

@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.7.1) +1 more potentially affected by CVE-2026-55602 via http-proxy-middleware (4.0.0)

http-proxy-middleware NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on http-proxy-middleware and may be impacted: - @oslokommune/auth-bff =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55602 Source advisory: MEND:CVE-2026-55602...

@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.8.3) +1 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=4.0.0, <=4.1.0)

http-proxy-middleware NPM version =4.0.0, =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55603 Source advisory: SNYK:JS-HTTPPROXYMIDDLEWARE-17375007...

@oslokommune/auth-bff (>=2.0.1, <=2.2.1), @sap/vite-plugin-leanix-custom-report (>=8.6.0, <=8.8.3) +1 more potentially affected by CVE-2026-55603 via http-proxy-middleware (>=4.0.0, <=4.1.0)

http-proxy-middleware NPM version =4.0.0, =2.0.1, =8.6.0, =0.4.5, =0.5.0 Source cves: CVE-2026-55603 Source advisory: OSV:GHSA-GCQ2-9PQ2-CXQM...

@angular-devkit/build-angular (>=20.0.0-next.0, <=20.3.16), @eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) +6 more potentially affected by CVE-2026-27739 via @angular/build (>=20.0.0-next.0, <=20.3.16)

@angular/build NPM version =20.0.0-next.0, =20.0.0-next.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.1.0, =0.0.0-pr-32415-1daf78a, =0.0.0-pr-32415-1daf78a, =0.1.3, =0.1.31 - ng-deploy-oss 20.0.0 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-ANGULARBUILD-15357312...

@eui/deps-base (>=21.0.0-alpha.10, <=23.0.0-alpha.1), @eui/deps-base-light (>=21.0.0-alpha.10, <=23.0.0-alpha.1) +1 more potentially affected by CVE-2026-27739 via @angular-devkit/build-angular (>=21.0.0-next.1, <=21.1.0)

@angular-devkit/build-angular NPM version =21.0.0-next.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =23.0.0-alpha.1 - ng-deploy-oss 21.0.0 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-ANGULARDEVKITBUILDANGULAR-15357315...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) +1 more potentially affected by CVE-2026-27739 via @angular-devkit/build-angular (>=20.0.0-rc.0, <=20.1.0)

@angular-devkit/build-angular NPM version =20.0.0-rc.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 - ng-deploy-oss 20.0.0 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-ANGULARDEVKITBUILDANGULAR-15357315...

@eui/deps-base (>=19.0.0-next.1, <=19.3.14), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.14) +4 more potentially affected by CVE-2026-27739 via @angular-devkit/build-angular (>=19.0.0-next.10, <=19.2.19)

@angular-devkit/build-angular NPM version =19.0.0-next.10, =19.0.0-next.1, =19.0.0-next.1, =19.0.0, =19.0.1 - @ws-test-realm/admin-kit 0.5.0-ng19 - @ws-test-realm/devkit 0.7.0-ng19 - ng-deploy-oss 19.0.0 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-ANGULARDEVKITBUILDANGULAR-15357315...

@angular-devkit/build-angular (>=20.1.0-next.3, <=20.2.0-next.2), @angular/build (>=20.1.0-next.3, <=20.2.0-next.2) +60 more potentially affected by CVE-2025-62522 via vite (>=7.0.0, <=7.0.6)

vite NPM version =7.0.0, =20.1.0-next.3, =20.1.0-next.3, =0.0.4, =0.2.9, =1.0.0, =1.190.0, =0.1.0, =19.3.2-snapshot-1752652198707, =19.3.2-snapshot-1752652198707, =0.0.1750946288791, =0.0.2, =0.3.0 and more Source cves: CVE-2025-62522 Source advisory: MEND:CVE-2025-62522...

@angular-devkit/build-angular (>=20.2.0-next.3, <=21.0.0-next.2), @angular/build (>=20.2.0-next.3, <=21.0.0-next.2) +29 more potentially affected by CVE-2025-58751 via vite (>=7.1.0, <=7.1.4)

vite NPM version =7.1.0, =20.2.0-next.3, =20.2.0-next.3, =2.1.2-alpha.0, =2.14.0, =30.0.0, =16.0.1, =21.0.0-alpha.10, =21.0.0-alpha.10, =2.19.8, =2.19.8, =14.314.0, =9.6.3, =0.0.0-snapshot-0360a7c2f707db55df213993503b56c6a1d96d0e, =0.0.0-snapshot-0360a7c2f707db55df213993503b56c6a1d96d0e,...

MAL-2025-6901 Malicious code in @angular_devkit/build_angular (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in @angular_devkit/build_angular (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in @angular_devkit/architect (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-6900 Malicious code in @angular_devkit/architect (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Malicious code in @angular_devkit/build-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 053dbd5b72c824b5644482986fcc9a5caca48fcbe447f90f957e420418f2bcb4 The OpenSSF Package Analysis project identified '@angulardevkit/build-webpack' @ 99.1.1 npm as malicious. It is considered malicious because: -...

MAL-2025-6870 Malicious code in @angular_devkit/build-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 053dbd5b72c824b5644482986fcc9a5caca48fcbe447f90f957e420418f2bcb4 The OpenSSF Package Analysis project identified '@angulardevkit/build-webpack' @ 99.1.1 npm as malicious. It is considered malicious because: -...