np-audit

np-audit — npm パッケージ監査ツール npm パッケージの静的セキュリティ解析 — 難読化されたライフサイクルスクリプト、既知の脆弱性、悪意のあるパターンを実行前に 検出します。npm install と npm ci のドロップイン代替品です。...

CVE-2026-45321-Tanstack

サプライチェーン攻撃シミュレーション — CVE-2026-45321 TanStack npm サプライチェーン攻撃、CI/CD の悪用、インストール時コード実行を理解するための教育用ラボ 免責事項 このプロジェクトは以下の目的のみで作成されています: サイバーセキュリティの学習、 ディフェンシブセキュリティの研究、 ローカルラボでのシミュレーション、 サプライチェーン攻撃の概念の理解。 このプロジェクトを以下の目的で使用しないでください: 実在のシステムへの攻撃、 認証情報の窃取、 マルウェアの展開、 不正アクセス、 またはその他の違法行為。 説明...

MAL-2026-16222 Malicious code in @traktis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...

MAL-2026-15866 Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

EUVD-2026-68816

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...

CVE-2026-82392

A flaw was found in pnpm, a package manager. An attacker can craft a malicious pnpm-lock.yaml file that, when processed by a user running pnpm install, allows package contents to be written outside the intended nodemodules directory. If the system is configured to allow lifecycle scripts, this pa...

CVE-2026-82392

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

Malicious code in confluence-create-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011485304eea045bddd134da5fdabfcf9d96acd0f2c78e1800a4c32674a5788c package.json declares a dependency whose key equals the package's own name confluence-create-content and whose value is a bare HTTPS URL,...

Malicious code in confluence-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7615f50c489336db7800ea3b79ef26a4e5af311f0484ee31871000e329c2813 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/confluence-editor rather than a semver range publish...

MAL-2026-15531 Malicious code in confluence-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7615f50c489336db7800ea3b79ef26a4e5af311f0484ee31871000e329c2813 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/confluence-editor rather than a semver range publish...

MAL-2026-15543 Malicious code in prm-bundles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e252184c7a4f29eafe72c86873c662342486b68fe5c1ce3a5405845aa8695a33 package.json line 11 declares a dependency whose key equals the package's own name prm-bundles and whose value is a bare HTTPS URL...

Malicious code in prm-bundles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e252184c7a4f29eafe72c86873c662342486b68fe5c1ce3a5405845aa8695a33 package.json line 11 declares a dependency whose key equals the package's own name prm-bundles and whose value is a bare HTTPS URL...

Malicious code in ir-annuities-client-authentication-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d813fc9c0831847a602c97803b7e53603edfb6acef4386e4cde2927c2a7a297 package.json declares a dependency whose key equals the package's own name ir-annuities-client-authentication-module and whose value is a plain HTTPS...

MAL-2026-15536 Malicious code in ir-annuities-client-authentication-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d813fc9c0831847a602c97803b7e53603edfb6acef4386e4cde2927c2a7a297 package.json declares a dependency whose key equals the package's own name ir-annuities-client-authentication-module and whose value is a plain HTTPS...

MAL-2026-15542 Malicious code in paper-password-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a97853ce25938b0cc295a798fa8c9ae8ab513126e70b93084785636a91bc7ec4 package.json declares a dependency whose key equals the package's own name paper-password-input and whose value is a bare HTTPS URL,...

Malicious code in paper-password-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a97853ce25938b0cc295a798fa8c9ae8ab513126e70b93084785636a91bc7ec4 package.json declares a dependency whose key equals the package's own name paper-password-input and whose value is a bare HTTPS URL,...