Malicious code in @uipath/tasks-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1924ebd0e25a511d934e9103d324a7e11db5dfad8820ff2a1f71d31ebd8eb8b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @uipath/platform-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89f494a30a8fe1637198b531a2c267ebb3aedf5d0c537afc1f12ea2186ef1d1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-3531 Malicious code in @uipath/apollo-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94aed6ca418c20be592feb819ad0ca041b5174750fb7f616d309cf6638448202 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ag-llm (>=0.1.0a0, <=0.1.0a1), ai-yardstick (0.0.1) +401 more potentially affected by CVE-2026-31236 via llm (>=0.4.1, <=0.32.0)

llm PYPI version =0.4.1, =0.1.0a0, =0.1.0, =0.1.0, =0.0.0, =0.1.0, =0.1.0, =0.8.0, =0.1.10, =0.0.1, =1.4.0, =1.0.0, =1.1.1 and more Source cves: CVE-2026-31236 Source advisory: SNYK:PYTHON-LLM-17675137...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

-fides-amor-et-lux (1.0.0), -price-checker (>=1.0.0, <=1.0.5) +33587 more potentially affected by CVE-2026-45736 via ws (>=8.0.0, <=8.20.0)

ws NPM version =8.0.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =1.0.0-beta.3 - 0g-vibekit 0.1.0 - 0g-zksettlement-client 1.0.0 - 0wcc9yywcywy 1.0.0 and more Source cves: CVE-2026-45736 Source advisory: SNYK:JS-WS-16722635...

CVE-2026-45181

Hex-Rays IDA Pro 9.2 and 9.3 before 9.3sp2 does not block Clang dependency-file generation via argument injection, which allows attackers to place their code into a plugins directory if the victim uses an attacker-supplied .i64 file...

@abiswas97/postgres-mcp (2.0.0), @adlanarifzr/mikro-orm-migrations (>=7.0.5-next.0, <=7.0.9) +687 more potentially affected by CVE-2026-32763 +1 more via kysely (>=0.26.3, <=0.28.16)

kysely NPM version =0.26.3, =7.0.5-next.0, =7.0.5-next.0, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =2.7.6, =0.2.0, =0.0.1, =0.0.17, =0.0.78 and more Source cves: CVE-2026-32763, CVE-2026-44635 Source advisory: SNYK:JS-KYSELY-16642092...

@abiswas97/postgres-mcp (2.0.0), @adlanarifzr/mikro-orm-migrations (>=7.0.5-next.0, <=7.0.9) +687 more potentially affected by CVE-2026-44635 via kysely (>=0.26.3, <=0.28.16)

kysely NPM version =0.26.3, =7.0.5-next.0, =7.0.5-next.0, =1.0.25-beta.0, =0.0.19, =1.2.6-beta.2, =2.7.6, =0.2.0, =0.0.1, =0.0.17, =0.0.78 and more Source cves: CVE-2026-44635 Source advisory: OSV:GHSA-PV5W-4P9Q-P3V2...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @getnuvo/importer-react (>=3.3.0, <=3.6.2) +19 more potentially affected by CVE-2026-43898 via @nyariv/sandboxjs (>=0.5.3, <=0.8.36)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =3.3.0, =4.0.1, =0.0.12-beta.0, =2.1.6, =2.1.6, =1.0.5, =1.0.6-alpha.12, =2.1.6, =2.1.6, =2.15.0, =0.2.0, =0.2.2 and more Source cves: CVE-2026-43898 Source advisory: SNYK:JS-NYARIVSANDBOXJS-16642341...

@afidos/nestjs-event-notifications (>=2.2.1, <=2.2.2), @getnuvo/importer-react (>=3.3.0, <=3.6.2) +19 more potentially affected by CVE-2026-43898 via @nyariv/sandboxjs (>=0.5.3, <=0.8.36)

@nyariv/sandboxjs NPM version =0.5.3, =2.2.1, =3.3.0, =4.0.1, =0.0.12-beta.0, =2.1.6, =2.1.6, =1.0.5, =1.0.6-alpha.12, =2.1.6, =2.1.6, =2.15.0, =0.2.0, =0.2.2 and more Source cves: CVE-2026-43898 Source advisory: OSV:GHSA-G8F2-4F4F-5JQW...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.24), @bubblesjs/vue-ai-chart (>=0.0.3, <=0.0.4) +158 more potentially affected by CVE-2026-41159 via mermaid (>=11.0.0, <=11.14.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.3, =0.15.0, =0.35.0, =0.0.1-beta.1, =0.0.0-beta.1, =0.0.1, =0.0.1-alpha.0, =0.11.1, =0.11.2, =1.10.5, =15.1.25, =0.0.2, =0.0.10 and more Source cves: CVE-2026-41159 Source advisory: OSV:GHSA-87F9-HVMW-GH4P...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.24), @bubblesjs/vue-ai-chart (>=0.0.3, <=0.0.4) +158 more potentially affected by CVE-2026-41159 via mermaid (>=11.0.0, <=11.14.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.3, =0.15.0, =0.35.0, =0.0.1-beta.1, =0.0.0-beta.1, =0.0.1, =0.0.1-alpha.0, =0.11.1, =0.11.2, =1.10.5, =15.1.25, =0.0.2, =0.0.10 and more Source cves: CVE-2026-41159 Source advisory: SNYK:JS-MERMAID-16642055...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +243 more potentially affected by CVE-2026-41159 via mermaid (>=10.0.0, <=10.9.5)

mermaid NPM version =10.0.0, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.17.1, =0.0.19, =0.0.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-41159 Source advisory: SNYK:JS-MERMAID-16642055...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +243 more potentially affected by CVE-2026-41159 via mermaid (>=10.0.0, <=10.9.5)

mermaid NPM version =10.0.0, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.17.1, =0.0.19, =0.0.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-41159 Source advisory: OSV:GHSA-87F9-HVMW-GH4P...

@8btc/excalidraw (>=0.18.0-beta.0, <=0.18.0-beta.4), @airmix/mcp-excalidraw-server (1.0.6) +243 more potentially affected by CVE-2026-41150 via mermaid (>=10.0.0, <=10.9.5)

mermaid NPM version =10.0.0, =0.18.0-beta.0, =0.17.0-alkemio-1, =1.0.0, =0.18.3, =0.18.0-1, =0.0.1-BETA, =0.18.1, =1.1.4, =0.0.1, =0.17.1, =0.0.19, =0.0.1, =0.0.1, =0.0.6 and more Source cves: CVE-2026-41150 Source advisory: SNYK:JS-MERMAID-16642040...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.24), @bubblesjs/vue-ai-chart (>=0.0.3, <=0.0.4) +158 more potentially affected by CVE-2026-41150 via mermaid (>=11.0.0, <=11.14.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.3, =0.15.0, =0.35.0, =0.0.1-beta.1, =0.0.0-beta.1, =0.0.1, =0.0.1-alpha.0, =0.11.1, =0.11.2, =1.10.5, =15.1.25, =0.0.2, =0.0.10 and more Source cves: CVE-2026-41150 Source advisory: OSV:GHSA-6M6C-36F7-FHXH...