Malicious code in @santieich/homebridge-midea-lan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c707aceedcdd649d0eb71ffd5a1d4ad46f43886869acb7be92d8a14012eb69db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11226 Malicious code in @santieich/homebridge-midea-lan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c707aceedcdd649d0eb71ffd5a1d4ad46f43886869acb7be92d8a14012eb69db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @santieich/homebridge-midea-lan is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

@sync-in/server (2.0.0), homebridge-config-ui-x (>=5.15.3-beta.3, <=5.17.1-beta.3) potentially affected by CVE-2026-2293 via @nestjs/platform-fastify (11.1.13)

@nestjs/platform-fastify NPM version 11.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/platform-fastify and may be impacted: - @sync-in/server 2.0.0 - homebridge-config-ui-x =5.15.3-beta.3, =5.17.1-beta.3 Source cves: CVE-2026-2293 Source...

Malicious code in homebridge-platform-smartac-f659675 (npm)

The package homebridge-platform-smartac-f659675 was found to contain malicious code...

Malicious code in homebridge-433mhz-light (npm)

The package homebridge-433mhz-light was found to contain malicious code...

MAL-2025-22514 Malicious code in homebridge-platform-smartac-f659675 (npm)

The package homebridge-platform-smartac-f659675 was found to contain malicious code...

Malicious code in homebridge-dyson (npm)

The package homebridge-dyson was found to contain malicious code...

MAL-2025-22512 Malicious code in homebridge-433mhz-light (npm)

The package homebridge-433mhz-light was found to contain malicious code...

MAL-2025-22513 Malicious code in homebridge-dyson (npm)

The package homebridge-dyson was found to contain malicious code...

@cromwell/cms (>=3.0.0-alpha.0, <=3.0.5), @cromwell/server (>=3.0.0-alpha.0, <=3.0.5) +4 more potentially affected by CVE-2023-25576 via @fastify/multipart (>=7.1.0, <=7.4.0)

@fastify/multipart NPM version =7.1.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =0.1.1, =2.42.0, =1.14.0, =0.50.5-test.0, =4.51.0-test.0 Source cves: CVE-2023-25576 Source advisory: OSV:GHSA-HPP2-2CR5-PF6G...

@wmfs/tymly-fastify-plugin (>=1.57.0, <=1.59.0), homebridge-config-ui-x (>=4.41.4-test.3, <=4.43.0-test.2) potentially affected by CVE-2021-23597 via fastify-multipart (>=5.2.1, <=5.3.0)

fastify-multipart NPM version =5.2.1, =1.57.0, =4.41.4-test.3, =4.43.0-test.2 Source cves: CVE-2021-23597 Source advisory: OSV:GHSA-QH73-QC3P-RJV2...

@alisowski/homebridge-samsungtv-control (2.0.2), @dustinblackman/homebridge-samsungtv-control (>=2.0.1, <=2.0.2) +2 more potentially affected by CVE-2020-7786 via macfromip (1.1.1)

macfromip NPM version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on macfromip and may be impacted: - @alisowski/homebridge-samsungtv-control 2.0.2 - @dustinblackman/homebridge-samsungtv-control =2.0.1, =2.0.0-alpha.1, =0.0.5, =0.2.7 Source cves...

@igames/ghost-cli (>=1.15.3, <=1.15.5), homebridge-ring (9.14.2) +1 more potentially affected by CVE-2021-21315 via systeminformation (>=5.0.6, <=5.1.2)

systeminformation NPM version =5.0.6, =1.15.3, =1.15.5 - homebridge-ring 9.14.2 - ring-client-api 9.14.2 Source cves: CVE-2021-21315 Source advisory: OSV:GHSA-2M8V-572M-FF2V...

box-node-sdk (>=1.16.0, <=1.16.1), homebridge-netatmo-schaloms (>=0.2.3, <=0.2.4) +6 more potentially affected by CVE-2018-3752 via merge-options (1.0.0)

merge-options NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge-options and may be impacted: - box-node-sdk =1.16.0, =0.2.3, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.13.1, =2.0.0, =2.0.1 Source cves: CVE-2018-3752 Source advisory:...