MAL-2026-11207 Malicious code in @404c3s4r/testxxx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bd0eb9a43f893d498f074432357cace7974802e77750075976412a8300599a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in svelte-metric-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76c232192bc12931cca4480eb306026c8ca4776ace0353ddb00fe7b947515b25 No malicious behaviors were identified in the package contents. No install-time lifecycle scripts fetching external code, no credential or environmen...

MAL-2026-11388 Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

Malicious code in streak-metrics-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3508138a215de5140d5c7922b41c602866a034ab1e8b28076f2cb734256844 The package advertises itself as a dependency-free calendar/streak math library but its main entrypoint dist/index.mjs contains a top-level IIFE that...

MAL-2026-11391 Malicious code in svelte-streak-metric (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc322e0a092d833331b172d9796648351685df0cc31d98f590288d859a00f77e The package contains no code paths matching supply-chain attack fingerprints: no install/postinstall lifecycle hooks fetching or executing remote...

MAL-2026-11400 Malicious code in thedata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...

Malicious code in switchpaymentsapiserv-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdf45ca375c6a15e134abf2ab456c8cbd75e514d934e2c16b1d2b23e9677186a The package's preinstall lifecycle script runs automatically on npm install and exfiltrates installer identity data via DNS. It collects...

MAL-2026-11269 Malicious code in consumerweb-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa886e4b335d3fc76fa6bc8e50c2e428ac164165830705c0ab2847857c2b3aa7 The package's preinstall lifecycle script runs automatically on npm install. It collects the installer's OS username os.userInfo.username, hostname...

SUSE CVE-2026-17831

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17832

Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17834

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17837

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17846

Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17851

Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17853

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17856

Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17866

Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17890

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-17916

Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-17940

Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Low...