armature-diesel (0.1.0), aruna_policy (>=0.1.0, <=0.1.2) +112 more potentially affected by unknown CVE via diesel (>=2.0.0, <=2.3.4)

diesel CARGO version =2.0.0, =0.1.0, =0.1.0, =0.6.0, =0.1.0, =0.1.0, =0.0.6, =0.1.1, =0.1.5, =0.1.0, =0.1.2, =0.1.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-Q8X8-JRHJ-FH9P...

Malicious code in venturo-playwright-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e63f5fe21c0fe70b9b120a217b3d1b14e765c47de231eb03d0d763c471fbd4e The package republishes Microsoft's @playwright/test under the unrelated name venturo-playwright-runner and falsifies its identity to claim Microsoft...

MAL-2026-4701 Malicious code in venturo-playwright-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e63f5fe21c0fe70b9b120a217b3d1b14e765c47de231eb03d0d763c471fbd4e The package republishes Microsoft's @playwright/test under the unrelated name venturo-playwright-runner and falsifies its identity to claim Microsoft...

MAL-2026-4700 Malicious code in venturo-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 602d8b957dc823f0dd6ac61f115e23fce1b433683873a9f4f8351dcbe9a37035 Package presents itself as Microsoft's Playwright: package.json description 'A high-level API to automate web browsers' is Playwright's exact tagline...

MAL-2026-4453 Malicious code in @tarojs/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b4e6cd0fe6bd16c6fb2bd04e6542a2a3052182d8815a08b124df56f2d9fde2 On npm install, the package's postinstall script performs a reachability GET to https://taro.jd.com/ and, on success, invokes the package's own...

apify-agent-mcp (>=0.1.0, <=0.2.0), codify-mcp (>=0.2.0, <=1.0.0) potentially affected by CVE-2026-46341 via @apify/actors-mcp-server (0.7.4)

@apify/actors-mcp-server NPM version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apify/actors-mcp-server and may be impacted: - apify-agent-mcp =0.1.0, =0.2.0, =1.0.0 Source cves: CVE-2026-46341 Source advisory: OSV:GHSA-JWP7-WG77-3W9V...

apify-agent-mcp (>=0.1.0, <=0.2.0), codify-mcp (>=0.2.0, <=1.0.0) potentially affected by CVE-2026-46341 via @apify/actors-mcp-server (0.7.4)

@apify/actors-mcp-server NPM version 0.7.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apify/actors-mcp-server and may be impacted: - apify-agent-mcp =0.1.0, =0.2.0, =1.0.0 Source cves: CVE-2026-46341 Source advisory:...

budibase (>=0.0.3, <=0.0.31) potentially affected by CVE-2026-46426 via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-46426 Source advisory: SNYK:JS-BUDIBASESERVER-17812797...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-46424 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-46424 Source advisory: SNYK:JS-BUDIBASEBACKENDCORE-16874300...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1040 more potentially affected by CVE-2026-45740 via protobufjs (>=8.0.0, <=8.0.3)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-45740 Source advisory: OSV:GHSA-JGGG-4JG4-V7C6...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3388 more potentially affected by CVE-2026-45740 via protobufjs (>=7.0.0, <=7.5.6)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-45740 Source advisory: OSV:GHSA-JGGG-4JG4-V7C6...

parley-core (>=0.2.0, <=0.6.1), pqc-combo (0.1.0) +2 more potentially affected by unknown CVE via libcrux-ml-dsa (>=0.0.4, <=0.0.8)

libcrux-ml-dsa CARGO version =0.0.4, =0.2.0, =0.6.1 - pqc-combo 0.1.0 - pqc-fips 0.0.3 - pqc-nostd 0.1.0 Source cves: unknown CVE Source advisory: OSV:GHSA-FHVH-VW7H-9XF3...

libcrux-aead (>=0.0.4-pre.1, <=0.0.7) potentially affected by unknown CVE via libcrux-chacha20poly1305 (>=0.0.4, <=0.0.7-rc.1)

libcrux-chacha20poly1305 CARGO version =0.0.4, =0.0.4-pre.1, =0.0.7 Source cves: unknown CVE Source advisory: OSV:GHSA-HC3C-63HC-2R9F...

@0xlimao/n8n-nodes-ethereum (>=1.0.0, <=1.0.1), @aayshian/n8n-aisensy-ay19 (0.0.1) +111 more potentially affected by unknown CVE via n8n-core (>=2.0.0, <=2.19.4)

n8n-core NPM version =2.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.3.6, =0.1.0, =1.0.0, =0.1.4, =1.1.3, =1.1.6 and more Source cves: unknown CVE Source advisory: SNYK:JS-N8NCORE-16874152...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +19 more potentially affected by CVE-2026-45669 via nuxt (>=4.0.0-rc.0, <=4.4.4)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-45669 Source advisory: OSV:GHSA-FX6J-W5W5-H468...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +53 more potentially affected by CVE-2026-45669 via nuxt (>=3.4.3, <=3.20.1)

nuxt NPM version =3.4.3, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.12.0-rc.7 and more Source cves: CVE-2026-45669 Source advisory: SNYK:JS-NUXT-16770149...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +53 more potentially affected by CVE-2026-45669 via nuxt (>=3.4.3, <=3.20.1)

nuxt NPM version =3.4.3, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.12.0-rc.7 and more Source cves: CVE-2026-45669 Source advisory: OSV:GHSA-FX6J-W5W5-H468...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +19 more potentially affected by CVE-2026-45669 via nuxt (>=4.0.0-rc.0, <=4.4.4)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-45669 Source advisory: SNYK:JS-NUXT-16770149...

Improper Encoding or Escaping of Output

Overview Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output due to improper escaping of single quotes in the SSH transport command construction process. An attacker can inject arbitrary shell tokens by including single quotes in the repository path,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...