@agilie/widget-template (>=1.0.6, <=1.1.6), @eui/deps-base (>=18.0.0-next.1, <=18.2.20) +9 more potentially affected by CVE-2026-50169 via @angular/service-worker (>=18.0.0, <=18.2.14)

@angular/service-worker NPM version =18.0.0, =1.0.6, =18.0.0-next.1, =18.0.0-next.1, =1.0.0, =12.0.0, =0.0.1, =1.0.0, =18.0.1, =0.0.1, =0.0.26 - ng-x-rocket 1.0.0 - table-collection-library 0.0.0 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...

@eui/deps-base (>=21.0.0-alpha.10, <=23.0.0-alpha.1), @eui/deps-base-light (>=21.0.0-alpha.10, <=23.0.0-alpha.1) potentially affected by CVE-2026-50169 via @angular/service-worker (>=21.0.0, <=21.2.11)

@angular/service-worker NPM version =21.0.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =23.0.0-alpha.1 Source cves: CVE-2026-50169 Source advisory: SNYK:JS-ANGULARSERVICEWORKER-17359086...

@eui/deps-base-light-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32), @eui/deps-base-next (>=19.2.2-snapshot-1746816578592, <=21.0.0-alpha.32) potentially affected by CVE-2026-50169 via @angular/service-worker (>=20.0.0, <=20.3.17)

@angular/service-worker NPM version =20.0.0, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =21.0.0-alpha.32 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...

@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50169 via @angular/service-worker (>=19.0.0, <=19.2.20)

@angular/service-worker NPM version =19.0.0, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-50168 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-50168 Source advisory: OSV:GHSA-XRXM-CP7J-8XF6...

create-momentum-app (>=0.0.1, <=0.5.11), foliokit (0.0.0) +1 more potentially affected by CVE-2026-50168 via @angular/platform-server (>=21.1.2, <=21.2.9)

@angular/platform-server NPM version =21.1.2, =0.0.1, =0.0.2, =0.0.3 Source cves: CVE-2026-50168 Source advisory: OSV:GHSA-XRXM-CP7J-8XF6...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-50168 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-50168 Source advisory: OSV:GHSA-XRXM-CP7J-8XF6...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4), @irshadali/ngx-indexed-db (>=19.3.0, <=19.3.1) +16 more potentially affected by CVE-2026-50168 via @angular/platform-server (>=18.2.13, <=18.2.14)

@angular/platform-server NPM version =18.2.13, =1.0.0, =19.3.0, =0.0.0, =12.0.0, =0.0.0, =1.0.2, =0.0.0, =1.0.0, =0.0.1, =0.0.2 - my-unique-workspace 0.0.0 - my-workspace01 0.0.0 and more Source cves: CVE-2026-50168 Source advisory: OSV:GHSA-XRXM-CP7J-8XF6...

@hmcts/ccd-case-ui-toolkit (>=7.3.49-4369, <=7.3.51), @hmcts/media-viewer (>=4.2.16-4435, <=4.2.17) +1 more potentially affected by CVE-2026-50168 via @angular/platform-server (>=20.0.0, <=20.3.19)

@angular/platform-server NPM version =20.0.0, =7.3.49-4369, =4.2.16-4435, =0.0.1-beta.25, =0.0.1-beta.30 Source cves: CVE-2026-50168 Source advisory: SNYK:JS-ANGULARPLATFORMSERVER-17357205...

@cosla/sensemaking-web-ui (>=1.0.5, <=1.0.8) potentially affected by CVE-2026-50168 via @angular/platform-server (19.2.18)

@angular/platform-server NPM version 19.2.18 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/platform-server and may be impacted: - @cosla/sensemaking-web-ui =1.0.5, =1.0.8 Source cves: CVE-2026-50168 Source advisory:...

@adeweb-be/volto-leaflet-block (0.2.0), @aws/nx-plugin (>=0.122.0, <=1.0.0-rc.23) +84 more potentially affected by CVE-2026-49982 via tmp (0.2.6)

tmp NPM version 0.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on tmp and may be impacted: - @adeweb-be/volto-leaflet-block 0.2.0 - @aws/nx-plugin =0.122.0, =4.8.16, =4.8.18 - @cairncms/api 1.1.0 - @cairncms/app 1.1.0 - @cairncms/composables 1.1.0 ...

003-gas-convert (1.0.1), 0x-hunter-core (>=1.0.0-3, <=1.0.1-5) +28840 more potentially affected by CVE-2026-48779 via ws (>=1.1.0, <=5.2.2)

ws NPM version =1.1.0, =1.0.0-3, =0.0.3, =1.1.0, =0.9.9, =1.0.0, =0.0.1, =0.11.3, =0.1.0, =1.0.2, =1.0.7 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

0.edsql (>=1.0.49, <=1.0.50), 0x-v4-nft (1.1.0) +8944 more potentially affected by CVE-2026-48779 via ws (>=7.0.0, <=7.5.10)

ws NPM version =7.0.0, =1.0.49, =0.0.11, =0.0.2, =1.0.0, =0.1.0, =0.0.12, =0.0.12, =0.1.0, =1.0.22, =3.10.1, =3.11.0 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +33756 more potentially affected by CVE-2026-48779 via ws (>=8.0.0, <=8.20.1)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit 0.1.0 - 0g-zksettlement-client 1.0.0 - 0wcc9yywcywy 1.0.0 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

003-gas-convert (1.0.1), 0x-hunter-core (>=1.0.0-3, <=1.0.1-5) +28840 more potentially affected by CVE-2026-48779 via ws (>=1.1.0, <=5.2.2)

ws NPM version =1.1.0, =1.0.0-3, =0.0.3, =1.1.0, =0.9.9, =1.0.0, =0.0.1, =0.11.3, =0.1.0, =1.0.2, =1.0.7 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

0.edsql (>=1.0.49, <=1.0.50), 0x-v4-nft (1.1.0) +8944 more potentially affected by CVE-2026-48779 via ws (>=7.0.0, <=7.5.10)

ws NPM version =7.0.0, =1.0.49, =0.0.11, =0.0.2, =1.0.0, =0.1.0, =0.0.12, =0.0.12, =0.1.0, =1.0.22, =3.10.1, =3.11.0 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

7ghost (>=4.11.25, <=4.11.46), @100mslive/hms-excalidraw (>=0.1.3, <=0.1.14) +1258 more potentially affected by CVE-2026-48779 via ws (>=6.0.0, <=6.2.3)

ws NPM version =6.0.0, =4.11.25, =0.1.3, =0.0.1-bate.30, =0.0.1, =0.0.1, =7.0.0-rc1, =0.1.0, =4.4.0-rc.1, =4.2.2, =2.9.0, =0.0.1-alpha.95, =1.0.0-alpha.46, =1.2.0, =1.6.2 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +33756 more potentially affected by CVE-2026-48779 via ws (>=8.0.0, <=8.20.1)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit 0.1.0 - 0g-zksettlement-client 1.0.0 - 0wcc9yywcywy 1.0.0 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

7ghost (>=4.11.25, <=4.11.46), @100mslive/hms-excalidraw (>=0.1.3, <=0.1.14) +1258 more potentially affected by CVE-2026-48779 via ws (>=6.0.0, <=6.2.3)

ws NPM version =6.0.0, =4.11.25, =0.1.3, =0.0.1-bate.30, =0.0.1, =0.0.1, =7.0.0-rc1, =0.1.0, =4.4.0-rc.1, =4.2.2, =2.9.0, =0.0.1-alpha.95, =1.0.0-alpha.46, =1.2.0, =1.6.2 and more Source cves: CVE-2026-48779 Source advisory: OSV:GHSA-96HV-2XVQ-FX4P...

Malicious code in nativescript-swisspost-imagepicker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2271ce1525f722f302ee59b9de3270020e6d1aa84d74cc2972cb6ffa34d9a62 package.json declares preinstall: node index.js. On npm install, index.js reads process.env.INITCWD the installing project's working directory, takes...