MAL-2026-17287 Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc8739717b3768c51a56da3a23b85b253b0bc08a2ab4a447e278d055c8a2e70 This package presents itself as a fork of the Baileys WhatsApp library. On every successful login through makeWASocket, lib/Socket/socket.js invokes...

Malicious code in @chatunity/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc8739717b3768c51a56da3a23b85b253b0bc08a2ab4a447e278d055c8a2e70 This package presents itself as a fork of the Baileys WhatsApp library. On every successful login through makeWASocket, lib/Socket/socket.js invokes...

aaa-ml-datasets-course (1.0.0), aerocm (0.1.0b0) +148 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.0.0, <=4.5.8)

jupyterlab PYPI version =4.0.0, =0.5.5, =2.0.0, =4.33.0, =1.0.1, =0.1.0, =1.6.4b1, =0.0.1, =1.8.2, =0.0.1, =0.3.1, =0.1.0, =0.1.4 - cad-viewer-widget 3.0.2 and more Source cves: CVE-2026-102904 Source advisory: MEND:CVE-2026-102904...

ag-toolkit (0.7.0), one-way-git-sync (6.0.49) +1 more potentially affected by CVE-2026-102829 via @simple-git/argv-parser (2.0.0)

@simple-git/argv-parser NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @simple-git/argv-parser and may be impacted: - ag-toolkit 0.7.0 - one-way-git-sync 6.0.49 - simple-git =4.0.0, =4.0.1 Source cves: CVE-2026-102829 Source advisory...

decentg-hybrid-mesh (1.0.0), decentralized-internet (>=5.3.6, <=5.4.3) +1 more potentially affected by CVE-2026-102831 via @jupyterlab/notebook (4.5.1)

@jupyterlab/notebook NPM version 4.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @jupyterlab/notebook and may be impacted: - decentg-hybrid-mesh 1.0.0 - decentralized-internet =5.3.6, =5.4.3 - dfarm 1.0.0 Source cves: CVE-2026-102831 Source...

andeplane-pyodide-kernel (>=0.0.7, <=0.0.12), here-search-demo (>=0.9.0, <=0.9.1) +17 more potentially affected by CVE-2026-102830 via jupyterlite-core (>=0.1.2, <=0.8.0rc0)

jupyterlite-core PYPI version =0.1.2, =0.0.7, =0.9.0, =0.1.0, =0.0.4, =0.1.0, =0.1.0, =0.1.1, =0.10.0, =0.2.1, =0.5.0, =0.1.0a4, =0.9.6, =0.1.0, =0.5.2 and more Source cves: CVE-2026-102830 Source advisory: MEND:CVE-2026-102830...

a2 (>=0.1.0, <=0.6.1), aaa-ml-datasets-course (1.0.0) +574 more potentially affected by CVE-2026-102830 via jupyterlab (>=3.0.0, <=4.5.8)

jupyterlab PYPI version =3.0.0, =0.1.0, =0.1.0b0, =0.1.0b0, =0.1.0b0, =0.1.0, =0.5.5, =2.0.0, =0.1.1, =0.1.0, =3.0.0, =4.33.0, =5.0.0 - arcor2-calibration 0.8.0 and more Source cves: CVE-2026-102830 Source advisory: MEND:CVE-2026-102830...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8006 more potentially affected by CVE-2026-102829 via @simple-git/argv-parser (>=1.1.1, <=2.0.0)

@simple-git/argv-parser NPM version =1.1.1, =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0, =1.0.3, =1.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-102829 Source advisory: MEND:CVE-2026-102829...

2context (>=0.1.0, <=0.2.0), 2ndopinion-cli (>=0.1.0, <=0.12.0) +8006 more potentially affected by CVE-2026-102828 via @simple-git/argv-parser (1.1.1)

@simple-git/argv-parser NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @simple-git/argv-parser and may be impacted: - 2context =0.1.0, =0.1.0, =0.16.0, =0.0.112-rc1, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =2.0.0,...

1508-cli (>=1.0.4, <=1.0.6), 2context (>=0.1.0, <=0.2.0) +12450 more potentially affected by CVE-2026-102828 via simple-git (>=1.63.0, <=3.36.0)

simple-git NPM version =1.63.0, =1.0.4, =0.1.0, =0.1.0, =1.0.0, =0.16.0, =0.0.80, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =1.33.0 and more Source cves: CVE-2026-102828 Source advisory: MEND:CVE-2026-102828...

1508-cli (>=1.0.4, <=1.0.6), 2context (>=0.1.0, <=0.2.0) +12507 more potentially affected by CVE-2026-102827 via simple-git (>=0.1.2, <=3.36.0)

simple-git NPM version =0.1.2, =1.0.4, =0.1.0, =0.1.0, =1.0.0, =0.16.0, =0.0.80, =1.0.0-beta.1, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =1.25.0, =1.33.0 and more Source cves: CVE-2026-102827 Source advisory: MEND:CVE-2026-102827...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-39244 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-39244 Source advisory: GHSA-RCW4-F5RP-G42V...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-102282 +1 more via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-102282, CVE-2026-104973 Source advisory: OSV:GHSA-J5F4-CC29-5X44...

0g-aura (>=0.1.0, <=0.4.31), 0g-kit (>=1.0.0, <=1.0.9) +16353 more potentially affected by CVE-2026-102282 via adm-zip (>=0.1.4, <=0.6.0)

adm-zip NPM version =0.1.4, =0.1.0, =1.0.0, =0.1.0, =0.2.9, =3.0.0-rc.0, =1.125.0, =1.2.2, =1.0.0, =1.0.0, =1.0.1, =1.0.10 and more Source cves: CVE-2026-102282 Source advisory: GHSA-J5F4-CC29-5X44...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.1.0-dev.260119.0a66443, <=0.3.0) +1988 more potentially affected by CVE-2026-18149 via undici (>=7.11.0, <=7.29.0)

undici NPM version =7.11.0, =0.1.1, =0.1.0-dev.260119.0a66443, =1.0.0, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =1.0.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-18149 Source advisory: GHSA-PMJH-FQ2X-6V4X...

3xhaustpi (>=0.1.3, <=0.2.5), @0x0.bug/pi-coding-agent (>=1.0.0, <=1.0.9) +1604 more potentially affected by CVE-2026-18149 via undici (>=8.0.0, <=8.10.1)

undici NPM version =8.0.0, =0.1.3, =1.0.0, =0.1.8, =0.3.5, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =5.0.1-staging.daf8e165bc4a -...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2130 more potentially affected by CVE-2026-19534 via undici (>=6.7.0, <=6.28.0)

undici NPM version =6.7.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =4.5.8, =4.5.8, =4.5.8, =4.5.8, =4.3.3, =1.0.0, =1.0.0, =0.1.5-alpha.0, =0.1.6 and more Source cves: CVE-2026-19534 Source advisory: GHSA-RFGV-XXQX-MFG5...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.1.0-dev.260119.0a66443, <=0.3.0) +1936 more potentially affected by CVE-2026-84890 via undici (>=7.15.0, <=7.29.0)

undici NPM version =7.15.0, =0.1.1, =0.1.0-dev.260119.0a66443, =1.0.0, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =1.0.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-84890 Source advisory: OSV:GHSA-3XPG-4RPP-HHHM...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +2098 more potentially affected by CVE-2026-84933 via undici (>=7.0.0, <=7.29.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =1.0.0, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =1.0.0, =1.52.3 and more Source cves: CVE-2026-84933 Source advisory: GHSA-2JFJ-6HJV-FM6J...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +2096 more potentially affected by CVE-2026-84947 via undici (>=7.1.0, <=7.29.0)

undici NPM version =7.1.0, =0.1.1, =0.0.1-251008.90016, =1.0.0, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =1.0.0, =1.52.3 and more Source cves: CVE-2026-84947 Source advisory: GHSA-2GQQ-GQF2-X968...