MAL-2026-17250 Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

MAL-2026-17281 Malicious code in @hrmony/valuenet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6f054c1d690a418a5d18f7d88883085468cc0bdfab8c604e69a82633d2de72 On require/import, the main module of @hrmony/valuenet auto-executes and POSTs installer-side secrets to the hardcoded attacker endpoint...

Malicious code in @hrmony/valuenet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6f054c1d690a418a5d18f7d88883085468cc0bdfab8c604e69a82633d2de72 On require/import, the main module of @hrmony/valuenet auto-executes and POSTs installer-side secrets to the hardcoded attacker endpoint...

MAL-2026-17277 Malicious code in @hrmony/pladddform-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...

MAL-2026-17276 Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

MAL-2026-17261 Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.2 Release.

Red Hat OpenShift Dev Spaces 3.30.2 has been released. The 3.30.2 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates to Dev Spaces 3.30. Red Hat OpenShift D...

ROOT-APP-NPM-GHSA-GV7W-RQVM-QJHR GHSA-gv7w-rqvm-qjhr in esbuild - Patched by Root

Root has patched GHSA-gv7w-rqvm-qjhr in the esbuild package for Root:npm. Multiple fixed versions available...

03-gs-ee-6 (0.3.5), @adhd/workspace-codegen-nx (>=0.1.3, <=0.1.5) +3135 more potentially affected by CVE-2026-102278 via brace-expansion (>=4.0.0, <=5.0.9)

brace-expansion NPM version =4.0.0, =0.1.3, =0.0.1-alpha.5, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 and more Source...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-102276 via brace-expansion (>=1.1.0, <=1.1.16)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-102276 Source advisory: SNYK:JS-BRACEEXPANSION-20244952...

0.extends.fc (1.0.65), 0.extends.react (1.0.51) +10440 more potentially affected by CVE-2026-100701 via nodemailer (>=5.0.0, <=10.0.1)

nodemailer NPM version =5.0.0, =1.0.49, =1.0.1, =1.0.0, =1.0.0, =0.2.9, =0.2.19 and more Source cves: CVE-2026-100701 Source advisory: OSV:GHSA-6VJ9-MWQ6-2F5V...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +246 more potentially affected by CVE-2026-101916 via @grpc/grpc-js (>=1.14.0, <=1.14.4)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.0.4, =0.0.33 and more Source cves: CVE-2026-101916 Source advisory: SNYK:JS-GRPCGRPCJS-20251010...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1690 more potentially affected by CVE-2026-102267 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.8, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-102267 Source advisory: SNYK:PYTHON-PYJWT-20250951...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (>=1.5.40, <=1.5.43) +32 more potentially affected by CVE-2026-84292 via fast-uri (>=3.0.1, <=3.1.6)

fast-uri NPM version =3.0.1, =0.3.1, =1.5.40, =1.6.0, =1.4.2, =1.2.0, =0.17.1, =5.4.3, =0.2.0-alpha.5, =0.1.0, =0.1.27 and more Source cves: CVE-2026-84292 Source advisory: GHSA-QW65-CVWX-89V3...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1593 more potentially affected by CVE-2026-102275 via pyjwt (>=2.1.0, <=2.14.0)

pyjwt PYPI version =2.1.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.8, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.5.2, =1.5.6 and more Source cves: CVE-2026-102275 Source advisory: OSV:PYSEC-2026-4183...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +29 more potentially affected by CVE-2026-102278 via brace-expansion (>=0.0.0, <=1.1.16)

brace-expansion NPM version =0.0.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.0, =2.0.0 - beelinejs-todo-mvc 0.1.1 - byte-common 1.0.0 - candlelabssdk 1.0.0 - capacitor-firebase-authentication 1.0.0 and more Source cves: CVE-2026-102278 Source advisory:...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +29 more potentially affected by CVE-2026-102277 via brace-expansion (>=0.0.0, <=1.1.16)

brace-expansion NPM version =0.0.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.0, =2.0.0 - beelinejs-todo-mvc 0.1.1 - byte-common 1.0.0 - candlelabssdk 1.0.0 - capacitor-firebase-authentication 1.0.0 and more Source cves: CVE-2026-102277 Source advisory:...

03-gs-ee-6 (0.3.5), @adhd/workspace-codegen-nx (>=0.1.3, <=0.1.5) +3135 more potentially affected by CVE-2026-102277 via brace-expansion (>=4.0.0, <=5.0.9)

brace-expansion NPM version =4.0.0, =0.1.3, =0.0.1-alpha.5, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 and more Source...