@alenon/grpc-mock-server (>=3.1.21, <=3.2.3), @aliceo2/bookkeeping (>=1.8.0, <=1.12.0) +129 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.13.0, <=1.13.4)

@grpc/grpc-js NPM version =1.13.0, =3.1.21, =1.8.0, =1.76.0, =1.0.0, =2.0.1, =1.0.7, =2.0.0, =1.1.37, =12.3.0, =0.3.1, =0.3.1, =0.3.8 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +132 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.14.0, <=1.14.3)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.2.2, =0.10.0, =0.56.0 - @bnonni/terminal 0.1.0 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

@alenon/grpc-mock-server (>=3.1.14, <=3.1.15), @aliceo2/bookkeeping (>=0.96.0, <=1.0.1) +84 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.11.0, <=1.11.3)

@grpc/grpc-js NPM version =1.11.0, =3.1.14, =0.96.0, =1.71.0, =0.0.10, =0.0.13, =0.0.10, =0.0.19, =0.0.10, =1.29.0, =0.1.0, =0.1.0, =0.2.5 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@42zeroo/tescik (>=1.0.0, <=1.1.1963), @agentbadge/evm-core (0.1.1) +351 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.12.0, <=1.12.6)

@grpc/grpc-js NPM version =1.12.0, =1.0.0, =0.1.15, =0.1.9, =0.1.8, =0.1.0, =0.1.1, =0.1.1, =0.1.1, =1.0.44, =3.1.16, =1.1.0, =1.7.0 and more Source cves: CVE-2026-48069 Source advisory: SNYK:JS-GRPCGRPCJS-17315972...

@1xtr/yc-log-client (>=1.0.6, <=1.1.1), @a11ywatch/a11ywatch (>=0.2.126, <=0.3.82) +126 more potentially affected by CVE-2026-48069 via @grpc/grpc-js (>=1.10.0, <=1.10.11)

@grpc/grpc-js NPM version =1.10.0, =1.0.6, =0.2.126, =0.8.16, =0.9.58, =4.4.29, =3.1.9, =0.78.0, =1.68.0, =5.7.3, =1.26.5, =8.5.1-alpha.4, =0.1.22, =3.5.2, =3.5.5 and more Source cves: CVE-2026-48069 Source advisory: OSV:GHSA-99F4-GRH7-6PCQ...

MAL-2026-5548 Malicious code in @403name/ether-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927758f43d6eaa6514273bd8ab8f3559624055b9bbf8c9ef9a190b645c0a6eef On require'@403name/ether-js', index.js runs an IIFE that targets macOS only returns early on non-darwin and when CI/GITHUBACTIONS env vars are set,...

PT-2026-48700

Name of the Vulnerable Software and Affected Versions KanaDojo versions prior to 0.1.18 Description A sandbox escape allows remote code execution with full GitHub Actions runner privileges, including access to the AUTOMATION PR TOKEN variable. The issue occurs in the issue-auto-respond.yml workfl...

Malicious code in @thomlecter1122/lab-helper-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75adb75a0025882efbcde3ddd88882aaaedfd692425222eda99c148096f1f58a The package ships a postinstall lifecycle script seccheck.js that fires automatically on npm install. The script first checks whether the host has a...

CVE-2026-46625 JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "proto" member is an own enumerable property,...

MAL-2026-5507 Malicious code in crypto-promise-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00594a3ae015e55e13c94c904866eae7b86a39b904b2d79469c4b59508c3918f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview crypto-promise-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in crypto-promise-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 00594a3ae015e55e13c94c904866eae7b86a39b904b2d79469c4b59508c3918f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-210106

image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or...

MAL-2026-5502 Malicious code in graphbase-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcdb883b3cbdcf4216f99f55d52d1b93db24271ddcf4a1e232f444a75709f76a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-45560: Improper Neutralization of Input During Web Page Generation

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, wrapline app/modules/common/common.py:181-186 and highlightword app/modules/common/common.py:188-192 build raw HTML by string concatenation with no escaping. The frontend...

CVE-2026-46625: Improperly Controlled Modification of Object Prototype Attributes

JavaScript Cookie is a JavaScript API for handling cookies, client-side. Prior to version 3.0.7, js-cookie's internal assign helper copies properties with for...in + plain assignment. When the source object is produced by JSON.parse, the JSON object's "proto" member is an own enumerable property,...

Malicious Package

Overview clsx-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview xorma-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer

The Miasma supply chain campaign has sparked a fresh attack wave called Hades , this time involving 37 malicious wheel artifacts across 19 packages in the Python Package Index PyPI registry, as the Mini Shai-Hulud-style attacks continue to be refined and splintered to target specific ecosystems...