0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2151 more potentially affected by CVE-2026-19534 via undici (>=6.7.0, <=6.28.0)

undici NPM version =6.7.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =2.7.0, =4.5.8, =4.5.8, =4.5.8, =4.5.8, =4.3.3, =1.0.0, =1.0.0, =2.1.1 and more Source cves: CVE-2026-19534 Source advisory: GHSA-RFGV-XXQX-MFG5...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.1.0-dev.260119.0a66443, <=0.29.0) +1963 more potentially affected by CVE-2026-84890 via undici (>=7.15.0, <=7.29.0)

undici NPM version =7.15.0, =0.1.1, =0.1.0-dev.260119.0a66443, =1.0.0, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =1.0.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-84890 Source advisory: OSV:GHSA-3XPG-4RPP-HHHM...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +2121 more potentially affected by CVE-2026-84933 via undici (>=7.0.0, <=7.29.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =1.0.0, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =1.0.0, =1.52.3 and more Source cves: CVE-2026-84933 Source advisory: GHSA-2JFJ-6HJV-FM6J...

@37chengshan/ompweb (>=0.3.5, <=5.1.9), @abox-dev/cli (>=0.1.0, <=0.2.1) +231 more potentially affected by CVE-2026-85152 via undici (>=8.10.0, <=8.10.1)

undici NPM version =8.10.0, =0.3.5, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.8.9, =1.0.0, =1.0.4, =1.0.0, =1.0.4, =1.0.0, =1.0.4, =1.0.0, =0.79.0, =0.85.0 and more Source cves: CVE-2026-85152 Source advisory: OSV:GHSA-VP8M-P9JH-Q5PM...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +2121 more potentially affected by CVE-2026-85014 via undici (>=7.0.0, <=7.29.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =1.0.0, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =1.0.0, =1.52.3 and more Source cves: CVE-2026-85014 Source advisory: GHSA-RX4F-C7P8-82VQ...

@adatechnology/conversation-module (>=0.2.0, <=0.4.2), @adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35) +307 more potentially affected by CVE-2026-92599 via joi (>=18.0.0, <=18.2.5)

joi NPM version =18.0.0, =0.2.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =3.19.0 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-92599 Source advisory: OSV:GHSA-6H2X-M376-MQJQ...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1769 more potentially affected by CVE-2026-92599 via joi (>=17.2.0, <=17.13.6)

joi NPM version =17.2.0, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-92599 Source advisory: OSV:GHSA-6H2X-M376-MQJQ...

@ascua/electron (>=0.8.0, <=0.18.0), @barnaby.build/barnaby (>=0.0.131, <=0.0.253) +66 more potentially affected by CVE-2026-102672 via electron (>=40.0.0, <=41.10.3)

electron NPM version =40.0.0, =0.8.0, =0.0.131, =1.1.1, =0.1.6, =0.28.2-next.1.g0672c8f47, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.4.2, =0.11.0, =9.10.13-beta.1, =9.10.13-beta.1, =0.6.1, =1.0.0 and more Source cves: CVE-2026-102672 Source advisory: GHSA-VV43-5JGX-7QV8...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +11 more potentially affected by CVE-2026-102673 via electron (>=41.0.3, <=41.10.3)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.2.2, =1.3.5 Source cves: CVE-2026-102673 Source advisory: SNYK:JS-ELECTRON-20335498...

@cafeai/cafe-code (0.0.28), @echomem/mcp (>=1.4.2, <=1.4.34) +11 more potentially affected by CVE-2026-102673 via electron (>=41.0.3, <=41.10.3)

electron NPM version =41.0.3, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.2.2, =1.3.5 Source cves: CVE-2026-102673 Source advisory: OSV:GHSA-HQ2X-R82H-9WJ4...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +13 more potentially affected by CVE-2026-102674 via electron (>=42.0.0, <=42.7.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.0.0-alpha.1, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.3.75, =0.3.91 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102674 Source advisory: SNYK:JS-ELECTRON-20335494...

@cafeai/cafe-code (0.0.28), @dualityinstitute/blink (>=0.0.1, <=0.0.18) +12 more potentially affected by CVE-2026-102674 via electron (>=41.0.3, <=41.10.5)

electron NPM version =41.0.3, =0.0.1, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.2.2, =1.3.5 Source cves: CVE-2026-102674 Source advisory: OSV:GHSA-GR2M-V5GQ-V685...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +13 more potentially affected by CVE-2026-102675 via electron (>=42.0.0, <=42.7.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.0.0-alpha.1, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.3.75, =0.3.91 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102675 Source advisory: OSV:GHSA-J84W-JFHQ-VHVJ...

@cafeai/cafe-code (0.0.28), @dualityinstitute/blink (>=0.0.1, <=0.0.18) +12 more potentially affected by CVE-2026-102675 via electron (>=41.0.3, <=41.10.5)

electron NPM version =41.0.3, =0.0.1, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.2.2, =1.3.5 Source cves: CVE-2026-102675 Source advisory: OSV:GHSA-J84W-JFHQ-VHVJ...

@cafeai/cafe-code (0.0.28), @dualityinstitute/blink (>=0.0.1, <=0.0.18) +12 more potentially affected by CVE-2026-102676 via electron (>=41.0.3, <=41.10.5)

electron NPM version =41.0.3, =0.0.1, =1.4.2, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.2.2, =1.3.5 Source cves: CVE-2026-102676 Source advisory: SNYK:JS-ELECTRON-20335447...

@0x-copilot/cli (>=0.1.0, <=0.2.0), @cafeai/cafe-code (>=0.0.35, <=0.0.36) +13 more potentially affected by CVE-2026-102676 via electron (>=42.0.0, <=42.7.1)

electron NPM version =42.0.0, =0.1.0, =0.0.35, =0.1.28, =0.1.0, =6.0.0, =0.0.0-alpha.1, =0.10.0, =0.1.4, =0.1.2, =0.1.1, =0.3.75, =0.3.91 - sunrize 2.1.5 - wrap-it-up 0.0.17 Source cves: CVE-2026-102676 Source advisory: OSV:GHSA-9QH4-3JW8-366W...

@0x-copilot/cli (>=0.2.1, <=0.3.0), @ascua/electron (>=0.19.0, <=0.26.0) +35 more potentially affected by CVE-2026-102677 via electron (>=43.0.0-beta.3, <=43.4.1)

electron NPM version =43.0.0-beta.3, =0.2.1, =0.19.0, =0.1.0, =9.10.29-beta.1, =9.10.29-beta.1, =6.7.0, =0.4.0, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 - @sharpcaterpillar/pi-web 0.8.11 and more Source cves: CVE-2026-102677 Source advisory: SNYK:JS-ELECTRON-20335433...

a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1430 more potentially affected by CVE-2026-49265 via oauthlib (>=3.0.0, <=3.3.1)

oauthlib PYPI version =3.0.0, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49265 Source advisory: GHSA-XPV3-W29H-X7CV...

MAL-2026-17253 Malicious code in @hrmony/benefit-essenszuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...

Malicious code in @hrmony/benefit-essenszuschuss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a91973dc3a793ffab820317714931c69f1a992ac1ebef3f80d8028976959939 On module import, top-level code in this package harvests cloud and container secrets and posts them to a hardcoded attacker-controlled endpoint. It...