MAL-2026-2052 Malicious code in @emilgroup/notification-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 064481cc260cfd8e135bc037198dd7baf6c95d4e7f41997cfad506e2627f0f8a The package @emilgroup/notification-sdk-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in @emilgroup/accounting-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81b18ede5b5fb4b02a83fa00e0ee9bed39f2a9aa04a952734abf0022f00f7bf4 The package @emilgroup/accounting-sdk-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2039 Malicious code in @emilgroup/billing-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08d6e9b450a96ca7b1280b8799dd80c62762d7025a50ea25eabf80c69eb0bb9e The package @emilgroup/billing-sdk-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2057 Malicious code in @emilgroup/payment-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83fcb6922c65850eff14baf7a463c2b14b358ffebdc5a15c312ec7328a142407 The package @emilgroup/payment-sdk-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2044 Malicious code in @emilgroup/customer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c6f159066f875aefa2d05b7fe166f8b55f075694d1badead1ec998bb6e396c The package @emilgroup/customer-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2041 Malicious code in @emilgroup/claim-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a86e7c53acc9840bac58a8ff7aca0a0d40a03ab2a8ac73dd55d0314373528800 The package @emilgroup/claim-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2068 Malicious code in eslint-config-ppf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cc85236d3cad46c2333a3252ffd8e3b96ae35f96a4ea2a4cb801d17c4e07390 The package eslint-config-ppf was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2049 Malicious code in @emilgroup/gdv-sdk-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c4f423945b0d9a114bae821ae46ab06d9850ba5611917eb80d940c47771e3ed The package @emilgroup/gdv-sdk-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in react-leaflet-heatmap-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2352243757a42dafc23c429819f6693b8f9a56799589414bbb527f35b1f7ed35 The package react-leaflet-heatmap-layer was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2071 Malicious code in react-leaflet-cluster-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0518fae392cbcd2e3f43b08af24b6736a313bcc053d67bfece2c36c7e609373 The package react-leaflet-cluster-layer was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2036 Malicious code in @emilgroup/auth-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b1a3b316a5288730ac37792c1fa0b0b17961a04a06250cb2c9a4d36acb3e117 The package @emilgroup/auth-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2067 Malicious code in babel-plugin-react-pure-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b646bc72d4de0e51f408bf6b7ae00d339ea8935a44b9bd71301a76337cc9b8d2 The package babel-plugin-react-pure-component was found to contain malicious code. Source: ghsa-malware...

Malicious code in @pypestream/floating-ui-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c054f1bdbe451e796bb0623296f4240c654e72b4ef794089dad3428bfed98fd2 The package @pypestream/floating-ui-dom was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2027 Malicious code in opengov-k6-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d6d3e0e21551377d17f0e85338f6ea9650b7c18f717b6e1060b1d50962ed112 The package opengov-k6-core was found to contain malicious code. Source: ghsa-malware 1370c540f2157e1e42d9edb109b0b6c57f27d35cfcfd8ebef2a5dc2d44db6e3...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

CVE-2026-33134

WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurarproduto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the idproduto GET parameter,...

CVE-2026-33134 WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter

WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurarproduto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the idproduto GET parameter,...

CVE-2026-33134 WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter

WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurarproduto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the idproduto GET parameter,...

CVE-2026-33134

CVE-2026-33134 affects WeGIA web manager (versions 3.6.5 and earlier). The vulnerability is an authenticated SQL injection in the endpoint html/matPat/restaurar_produto.php, where the parameter id_produto is read from $_GET and directly interpolated into two SQL query strings without sanitization...

Malicious code in chai-as-chayn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37e4fe08f70ebcaf1ebc9988e7ad2694a3b9708734e8623adcf930d1803bb72a The package chai-as-chayn was found to contain malicious code. Source: ghsa-malware 57e4b17532a62987684bdd644c433a1aa7c4955324bb06eb3c6f7ed702fa0ed3...