Malicious code in @orion-design-system/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edd5d007da2de0a07fc1a0d999cccbf71a748627c82c9b2000d161eb248a5a0f package.json declares a preinstall hook that runs an inline node -e script reading os.hostname and os.userInfo.username and transmitting them via HTT...

MAL-2026-5522 Malicious code in @orion-design-system/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edd5d007da2de0a07fc1a0d999cccbf71a748627c82c9b2000d161eb248a5a0f package.json declares a preinstall hook that runs an inline node -e script reading os.hostname and os.userInfo.username and transmitting them via HTT...

Malicious code in @orion-design-system/store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4218505b74ba258cea12df713bbc27db9fa58d6660cf83e6d0c5fd8a9f68a4c2 package.json declares a preinstall script that runs on every npm install. The script uses node -e to require os and https, reads os.hostname and...

Malicious code in morningstar-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18591ac1a5cb5ca3d11e07bde38f230dccc530bb4614d45f9be1f547677a2c9e On npm install, the package's preinstall lifecycle script runs wget against a hardcoded bare-IP HTTP endpoint, passing the output of id, pwd, hostnam...

Malicious code in @cloudways-lab/unified-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d7eef784b4e8296e2533e27c1afb116c4c519ac9adda0fbb53661ce6d01e060 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @design-system-coopeuch/web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a871445c3913d747a2f1383bcfdac02d6dec26ddb2053260340284cf4ee02233 Package @design-system-coopeuch/[email protected] is a dependency-confusion squat of an internal-looking scope, published at an inflated 999.x version to...

MAL-2026-3653 Malicious code in @design-system-coopeuch/web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a871445c3913d747a2f1383bcfdac02d6dec26ddb2053260340284cf4ee02233 Package @design-system-coopeuch/[email protected] is a dependency-confusion squat of an internal-looking scope, published at an inflated 999.x version to...

MAL-2026-3421 Malicious code in oneblk-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f46bbc3e155a30851463f65a3f9d5af33ebd5172df5ad70f7b022a77448fc6eb The package oneblk-design-system was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in oneblk-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f46bbc3e155a30851463f65a3f9d5af33ebd5172df5ad70f7b022a77448fc6eb The package oneblk-design-system was found to contain malicious code. Source: ossf-package-analysis...

CVE-2026-7596

A vulnerability has been found in nextlevelbuilder ui-ux-pro-max-skill up to 2.5.0. Affected by this issue is the function data.get of the file .claude/skills/design-system/scripts/generate-slide.py of the component Slide Generator. Such manipulation leads to cross site scripting. The attack may ...

Malicious code in experian-design-system-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e90ccd6c3568a7aef645cab8ed450ccd3a6161c82b6e9ba03eab795510e35847 The package experian-design-system-themes was found to contain malicious code. Source: ghsa-malware...

Malicious code in components-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca129c441caef97d904867f91617f53799650e2f2deef3f531a3a18dfc917efa The package components-design-system was found to contain malicious code...

MAL-2026-1696 Malicious code in components-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca129c441caef97d904867f91617f53799650e2f2deef3f531a3a18dfc917efa The package components-design-system was found to contain malicious code...

Malicious code in navi-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d7c20b1a93d0713a7cd64e5937906dc8db43fe90795827cedac30fc64031c68 The package navi-design-system was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-1494 Malicious code in navi-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d7c20b1a93d0713a7cd64e5937906dc8db43fe90795827cedac30fc64031c68 The package navi-design-system was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in bps-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f41e4d6abfba5f03e914140b0b171314ef8a614e3e03ff9685325532260a745 The package bps-design-system was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-1087 Malicious code in bps-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f41e4d6abfba5f03e914140b0b171314ef8a614e3e03ff9685325532260a745 The package bps-design-system was found to contain malicious code. Source: ossf-package-analysis...

Cross-site Scripting (XSS)

Overview @n8n/design-system is a Affected versions of this package are vulnerable to Cross-site Scripting XSS via the markdown rendering process in the workflow user interface. An attacker can execute arbitrary scripts in the context of another user's session by crafting malicious markdown conten...

@n8n/chat (1.2.0) potentially affected by CVE-2026-25054 via @n8n/design-system (2.2.0)

@n8n/design-system NPM version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/design-system and may be impacted: - @n8n/chat 1.2.0 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

@like-a-startup/matildex-chat (>=1.0.8, <=1.0.14), @n8n/chat (>=0.46.0, <=0.68.0) +3 more potentially affected by CVE-2026-25054 via @n8n/design-system (>=1.88.0, <=1.110.0)

@n8n/design-system NPM version =1.88.0, =1.0.8, =0.46.0, =1.0.0, =1.0.4 - navis-n8n-chat-ui 1.0.1 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...