Malicious code in hease-js-api (npm)

The package hease-js-api was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cortex-js-api (npm)

The package cortex-js-api was found to contain malicious code. --- Credit: OpenSSF source...

CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-51937

An issue in Oneblog V2.3.9 allows a remote attacker to obtain sensitive information via the RestApiController.java, JsApiTicketComponent.java, and the GetAccessTokenComponent.java component...

Malicious Package

Overview @hpcc/js-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2584 Malicious code in @hpcc/js-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66d87d26a2f328414129f2abca4fe30a3f49afcefc1734ff29504b30e8e5e538 The package @hpcc/js-api was found to contain malicious code. Source: ghsa-malware baed13149b187a8ebee8b70891d8c38114a2f8c25e0048e5f2524ae8cb61217e A...

Malware in @hpcc/js-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

ourtunes (>=0.0.0, <=1.1.0), play-url (>=0.0.2, <=0.0.5) potentially affected by unknown CVE via rdio-js-api (0.0.6)

rdio-js-api NPM version 0.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on rdio-js-api and may be impacted: - ourtunes =0.0.0, =0.0.2, =0.0.5 Source cves: unknown CVE Source advisory: OSV:MAL-2025-31754...

MAL-2025-22331 Malicious code in hease-js-api (npm)

The package hease-js-api was found to contain malicious code...

Malicious code in rdio-js-api (npm)

The package rdio-js-api was found to contain malicious code...

MAL-2025-17598 Malicious code in cortex-js-api (npm)

The package cortex-js-api was found to contain malicious code...

Malicious code in hease-js-api (npm)

The package hease-js-api was found to contain malicious code...

MAL-2025-31754 Malicious code in rdio-js-api (npm)

The package rdio-js-api was found to contain malicious code...

Malicious code in cortex-js-api (npm)

The package cortex-js-api was found to contain malicious code...

CVE-2025-30215

NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27 and 2.11.1, the management of JetStream assets happens with messages in the $JS. subject namespace in the system account; this is partially expose...

@galenjs/framework-next (>=1.0.0, <=1.7.0), @galenjs/models (>=1.1.11-alpha.0, <=1.7.0) +4 more potentially affected by CVE-2023-22578 via @sequelize/core (7.0.0-alpha.10)

@sequelize/core NPM version 7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11-alpha.0, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22578 Sourc...

@galenjs/framework-next (>=1.0.0, <=1.7.0), @galenjs/models (>=1.1.11-alpha.0, <=1.7.0) +4 more potentially affected by CVE-2023-22579 via @sequelize/core (7.0.0-alpha.10)

@sequelize/core NPM version 7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11-alpha.0, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22579 Sourc...

@galenjs/framework-next (>=1.0.0, <=1.7.0), @galenjs/models (>=1.1.11-alpha.0, <=1.7.0) +4 more potentially affected by CVE-2023-22579 via @sequelize/core (7.0.0-alpha.10)

@sequelize/core NPM version 7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11-alpha.0, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22579 Sourc...

@galenjs/framework-next (>=1.0.0, <=1.7.0), @galenjs/models (>=1.1.11-alpha.0, <=1.7.0) +4 more potentially affected by CVE-2023-22580 via @sequelize/core (7.0.0-alpha.10)

@sequelize/core NPM version 7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11-alpha.0, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22580 Sourc...

@galenjs/framework-next (>=1.0.0, <=1.7.0), @galenjs/models (>=1.1.11-alpha.0, <=1.7.0) +4 more potentially affected by CVE-2023-22580 via @sequelize/core (7.0.0-alpha.10)

@sequelize/core NPM version 7.0.0-alpha.10 is affected by a known vulnerability. The following packages have a transitive dependency on @sequelize/core and may be impacted: - @galenjs/framework-next =1.0.0, =1.1.11-alpha.0, =0.0.2, =0.0.2, =0.0.30, =0.1.0, =0.1.1 Source cves: CVE-2023-22580 Sourc...