@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +719 more potentially affected by CVE-2026-9679 via undici (>=7.0.0, <=7.27.2)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.33, =0.1.8, =0.0.1, =1.0.0, =0.1.7, =21.0.0-rc.2, =21.0.0-rc.2, =21.2.17 and more Source cves: CVE-2026-9679 Source advisory: SNYK:JS-UNDICI-17372658...

@0xwork/connect (>=0.1.0, <=0.1.9), @a5c-ai/agent-platform (>=5.0.1-staging.19033314d476, <=5.0.1-staging.e195a4980892) +503 more potentially affected by CVE-2026-9675 via undici (>=8.0.0, <=8.4.1)

undici NPM version =8.0.0, =0.1.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =2026.6.2, =1.0.0, =0.6.10, =0.3.1, =2026.4.23-zh, =0.2.0, =0.10.1 and more Source cves:...

@0xwork/connect (>=0.1.0, <=0.1.9), @a5c-ai/agent-platform (>=5.0.1-staging.19033314d476, <=5.0.1-staging.e195a4980892) +503 more potentially affected by CVE-2026-9697 via undici (>=8.0.0, <=8.4.1)

undici NPM version =8.0.0, =0.1.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =2026.6.2, =1.0.0, =0.6.10, =0.3.1, =2026.4.23-zh, =0.2.0, =0.10.1 and more Source cves:...

@aegis-scan/core (>=0.18.1, <=0.19.0), @aegis-scan/reporters (>=0.18.4, <=0.19.0) +380 more potentially affected by CVE-2026-9697 via undici (>=7.24.0, <=7.27.2)

undici NPM version =7.24.0, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.1.8, =0.1.7, =21.2.4, =21.2.4, =0.1.0, =0.18.0, =0.1.0, =0.4.0, =0.1.0, =0.0.1, =0.1.2 and more Source cves: CVE-2026-9697 Source advisory: SNYK:JS-UNDICI-17372609...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +319 more potentially affected by CVE-2026-9595 via webpack-dev-server (>=5.0.0, <=5.2.4)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =0.18.3, =0.0.1, =0.3.2 and more Source cves: CVE-2026-9595 Source advisory: OSV:GHSA-MX8G-39Q3-5C7...

02url-querystring-http (>=1.0.1, <=1.0.4), 1-0-5-hai-aage-dekhte-hein-kya-aat-hai (>=1.0.5, <=1.0.6) +12635 more potentially affected by CVE-2026-5079 via multer (>=1.0.3, <=2.1.1)

multer NPM version =1.0.3, =1.0.1, =1.0.5, =2.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0, =1.0.3 - 6e-alpha-backend-admin 1.0.0 and more Source cves: CVE-2026-5079 Source advisory: OSV:GHSA-72GW-MP4G-V24J...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1550 more potentially affected by CVE-2026-5038 via multer (>=2.0.0, <=2.1.1)

multer NPM version =2.0.0, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-5038 Source advisory: OSV:GHSA-3P4H-7M6X-2HCM...

1shot (>=0.0.3, <=0.0.9), @4via6/relay (>=1.0.0, <=1.1.3) +251 more potentially affected by CVE-2026-54316 via @anthropic-ai/claude-code (>=0.2.126, <=2.1.154)

@anthropic-ai/claude-code NPM version =0.2.126, =0.0.3, =1.0.0, =2.1.0, =0.1.18, =1.0.0, =0.4.0, =1.0.0, =0.2.3, =0.0.1, =0.0.1, =0.0.55, =0.0.69 and more Source cves: CVE-2026-54316 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-17391874...

1shot (>=0.0.3, <=0.0.9), @4via6/relay (>=1.0.0, <=1.1.3) +251 more potentially affected by CVE-2026-54316 via @anthropic-ai/claude-code (>=0.2.126, <=2.1.154)

@anthropic-ai/claude-code NPM version =0.2.126, =0.0.3, =1.0.0, =2.1.0, =0.1.18, =1.0.0, =0.4.0, =1.0.0, =0.2.3, =0.0.1, =0.0.1, =0.0.55, =0.0.69 and more Source cves: CVE-2026-54316 Source advisory: OSV:GHSA-FG94-H982-F3MM...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53840 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53840 Source advisory: OSV:GHSA-RJXQ-QQHF-8HWH...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53840 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53840 Source advisory: SNYK:JS-OPENCLAW-17394026...

MAL-2026-6065 Malicious code in lab-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4acaa72e3c14b79785540c878cb48f7a0cdc238d20ac9cebd6ffdd42061f6e7b On npm install, the package's preinstall lifecycle script node.js collects host identifiers from the installing machine — hostname, public IP resolve...

@liqi0816/chrome-devtools-mcp-rebrowser (>=1.0.0, <=1.0.3), @mallocfeng/chromedev (>=0.1.0, <=0.1.8) +10 more potentially affected by CVE-2026-53765 via chrome-devtools-mcp (>=0.20.3, <=0.25.0)

chrome-devtools-mcp NPM version =0.20.3, =1.0.0, =0.1.0, =0.2.8, =0.2.7, =2.0.0, =0.1.5, =1.0.5, =1.0.0, =1.0.1, =1.0.9 Source cves: CVE-2026-53765 Source advisory: OSV:GHSA-3PVJ-JV98-QHJQ...

@liqi0816/chrome-devtools-mcp-rebrowser (>=1.0.0, <=1.0.3), @mallocfeng/chromedev (>=0.1.0, <=0.1.8) +10 more potentially affected by CVE-2026-53765 via chrome-devtools-mcp (>=0.20.3, <=0.25.0)

chrome-devtools-mcp NPM version =0.20.3, =1.0.0, =0.1.0, =0.2.8, =0.2.7, =2.0.0, =0.1.5, =1.0.5, =1.0.0, =1.0.1, =1.0.9 Source cves: CVE-2026-53765 Source advisory: SNYK:JS-CHROMEDEVTOOLSMCP-17391448...

@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.016f0b0e8119, <=5.0.1-staging.ffad3b46492e) +293 more potentially affected by CVE-2026-54325 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.1)

@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.078c111a306a, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.3abdf9534c25, =0.6.4, =0.3.1, =0.4.7, =2026.5.12-zh,...

@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.016f0b0e8119, <=5.0.1-staging.ffad3b46492e) +293 more potentially affected by CVE-2026-54325 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.1)

@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.078c111a306a, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.3abdf9534c25, =0.6.4, =0.3.1, =0.4.7, =2026.5.12-zh,...

0xkobold (>=0.0.1, <=0.8.0), @0xwork/connect (>=0.1.0, <=0.1.7) +546 more potentially affected by CVE-2026-54328 via @mariozechner/pi-coding-agent (>=0.50.1, <=0.73.1)

@mariozechner/pi-coding-agent NPM version =0.50.1, =0.0.1, =0.1.0, =1.0.0-alpha, =0.0.183-staging.22859086, =5.0.0, =0.1.6-staging.22859086, =0.1.1-staging.04cc300a, =4.0.153, =0.1.1-staging.04cc300a, =0.1.0, =0.1.1-staging.29187771, =0.1.1-staging.0dc03363, =0.0.2-staging.29187771, =0.1.0,...

0xkobold (>=0.0.1, <=0.8.0), @0xwork/connect (>=0.1.0, <=0.1.7) +546 more potentially affected by CVE-2026-54328 via @mariozechner/pi-coding-agent (>=0.50.1, <=0.73.1)

@mariozechner/pi-coding-agent NPM version =0.50.1, =0.0.1, =0.1.0, =1.0.0-alpha, =0.0.183-staging.22859086, =5.0.0, =0.1.6-staging.22859086, =0.1.1-staging.04cc300a, =4.0.153, =0.1.1-staging.04cc300a, =0.1.0, =0.1.1-staging.29187771, =0.1.1-staging.0dc03363, =0.0.2-staging.29187771, =0.1.0,...

@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.016f0b0e8119, <=5.0.1-staging.ffad3b46492e) +259 more potentially affected by CVE-2026-54328 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.0)

@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.078c111a306a, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.3abdf9534c25, =0.6.4, =0.3.1, =0.4.7, =2026.5.12-zh,...

@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.016f0b0e8119, <=5.0.1-staging.ffad3b46492e) +259 more potentially affected by CVE-2026-54328 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.0)

@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.078c111a306a, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.3abdf9534c25, =0.6.4, =0.3.1, =0.4.7, =2026.5.12-zh,...