@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +36 more potentially affected by CVE-2026-102677 via electron (>=43.0.0-beta.3, <=43.4.1)

electron NPM version =43.0.0-beta.3, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =5.0.18-rc.1, =5.0.18 and more Source cves: CVE-2026-102677 Source advisory: SNYK:JS-ELECTRON-20335433...

@1-click/shared-lib (0.0.1), @20206205tech/nestjs-auth (>=1.0.0, <=1.4.1) +865 more potentially affected by unknown CVE via js-yaml (>=5.0.0, <=5.4.0)

js-yaml NPM version =5.0.0, =1.0.0, =0.3.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =1.1.0, =1.1.0, =16.21.1, =1.9.29, =6.29.8, =3.4.141, =7.1.20, =2.2.62, =2.2.73 and more Source cves: unknown CVE Source advisory: GHSA-R3PH-W7GJ-G6XM...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1429 more potentially affected by CVE-2026-49265 via oauthlib (>=3.0.0, <=3.3.1)

oauthlib PYPI version =3.0.0, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49265 Source advisory: GHSA-XPV3-W29H-X7CV...

@chrysb/alphaclaw (>=0.9.35-beta.0, <=0.9.36), @moltzap/simulator (>=2026.902.0, <=2026.922.3) +1 more potentially affected by CVE-2026-102807 via openclaw (>=2026.8.1, <=2026.9.3)

openclaw NPM version =2026.8.1, =0.9.35-beta.0, =2026.902.0, =1.0.0, =1.2.8 Source cves: CVE-2026-102807 Source advisory: MEND:CVE-2026-102807...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +12 more potentially affected by CVE-2026-102675 via electron (>=42.0.0, <=42.7.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.3.75, =0.3.91 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102675 Source advisory: MEND:CVE-2026-102675...

0.app1 (1.0.52), 0.edsql (>=1.0.49, <=1.0.50) +3067 more potentially affected by CVE-2026-102674 via electron (>=0.1.2, <=41.10.5)

electron NPM version =0.1.2, =1.0.49, =1.0.49, =1.0.49, =1.0.1, =0.0.10, =1.0.2, =1.1.11, =0.1.0, =1.0.1 - @aaquib/whatsasenanpm 1.3.5 - @aaronngray/electron-spawn 5.0.0 and more Source cves: CVE-2026-102674 Source advisory: MEND:CVE-2026-102674...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +11 more potentially affected by CVE-2026-102673 via electron (>=42.0.0, <=42.4.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.1.20 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102673 Source advisory: MEND:CVE-2026-102673...

0.app1 (1.0.52), 0.edsql (>=1.0.49, <=1.0.50) +3066 more potentially affected by CVE-2026-102673 via electron (>=0.1.2, <=41.10.3)

electron NPM version =0.1.2, =1.0.49, =1.0.49, =1.0.49, =1.0.1, =0.0.10, =1.0.2, =1.1.11, =0.1.0, =1.0.1 - @aaquib/whatsasenanpm 1.3.5 - @aaronngray/electron-spawn 5.0.0 and more Source cves: CVE-2026-102673 Source advisory: MEND:CVE-2026-102673...

Malicious code in @hrmony/benefit-essenszuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...

MAL-2026-17253 Malicious code in @hrmony/benefit-essenszuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...

Malicious code in @hrmony/account-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b699bc4a206505ba0cf224888996e37fe00dff5ffb737e3b95b9fd139b910f The main module executes on require/import via a top-level await. It queries the AWS IMDSv2 metadata service at 169.254.169.254 to retrieve instance...

MAL-2026-17262 Malicious code in @hrmony/interfaces (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7837cf2dff543cfea2f35e0dea5f767ca7b8e8f81129f4c770e5693ed247c0e index.js executes top-level async code on any require/import of the package. The code 1 obtains an AWS IMDSv2 token and fetches EC2 instance identity...

Malicious code in @hrmony/interfaces (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7837cf2dff543cfea2f35e0dea5f767ca7b8e8f81129f4c770e5693ed247c0e index.js executes top-level async code on any require/import of the package. The code 1 obtains an AWS IMDSv2 token and fetches EC2 instance identity...

Malicious code in @hrmony/benefit-mobilitaet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf87d41e53e59a65644aaf92de291a5943afa017fbdc2068ebb6741383f60688 On module load, index.js unconditionally contacts the EC2 Instance Metadata Service at 169.254.169.254, obtains an IMDSv2 token, and retrieves instan...

MAL-2026-17255 Malicious code in @hrmony/benefit-mobilitaet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf87d41e53e59a65644aaf92de291a5943afa017fbdc2068ebb6741383f60688 On module load, index.js unconditionally contacts the EC2 Instance Metadata Service at 169.254.169.254, obtains an IMDSv2 token, and retrieves instan...

Malicious code in @hrmony/organisationsverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78807365ee9728923ec2d5d103ce7f4562b21e2fc8185483b482bb5d2f79748d @hrmony/organisationsverwaltung 7.99.0 executes credential-theft code at the top level of index.js, so simply requiring or importing the package...

MAL-2026-17270 Malicious code in @hrmony/organisationsverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78807365ee9728923ec2d5d103ce7f4562b21e2fc8185483b482bb5d2f79748d @hrmony/organisationsverwaltung 7.99.0 executes credential-theft code at the top level of index.js, so simply requiring or importing the package...

MAL-2026-17256 Malicious code in @hrmony/benefit-sachbezug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...

Malicious code in @hrmony/benefit-sachbezug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...

Malicious code in @hrmony/benefitverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a567d870fdf9c4fecac3e9fbb009a5b23e4450ea608d416564095680dc5bc4b2 On top-level import, the package's main module POSTs an initial identifying beacon body "c53":"hello" to the hardcoded endpoint...