ROOT-APP-NPM-CVE-2024-34350 CVE-2024-34350 in next - Patched by Root

Root has patched CVE-2024-34350 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-23646 CVE-2022-23646 in next - Patched by Root

Root has patched CVE-2022-23646 in the next package for Root:npm. Multiple fixed versions available...

PT-2026-100423

Security vulnerability affects the npm package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100499

Security vulnerability affects the npm package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100714

Security vulnerability affects the npm package. This issue is resolved in later releases. See references for vulnerability details...

ROOT-APP-NPM-CVE-2026-56876 CVE-2026-56876 in extract-zip - Patched by Root

Root has patched CVE-2026-56876 in the extract-zip package for Root:npm. Multiple fixed versions available...

Duplicate Advisory: joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6h2x-m376-mqjq. This link is maintained to preserve external references. Original Description joi npm package joi, hapi.js versions =17.2.0 =18.0.0 18.2.6 are vulnerable to regular expression denial of service i...

Malicious code in chai-as-agile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263 On require'chai-as-agile', index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to...

Malicious code in strapi-plugin-pencc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4277c223cb7d5a9b8c263570a18670ee5054779862fbb801024a55629aa208 postinstall.js is registered as the package's postinstall script and runs automatically on npm install. It compares os.hostname to the hardcoded stri...

Malicious code in otel-span-adapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e800a0d88fb9a757c0ca5ecc09f0217522e72575d3e570a87c167090740de7d The package presents itself as an OpenTelemetry span adapter but on module load schedules a bootstrap routine via setImmediate that reads...

Malicious code in @prime0/pcomatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08299e41eb4feb9e324854bf5cd3386e6e52696b4b11443254374897a1ad3816 index.js and the postinstall lifecycle script contact a hardcoded bare-IP endpoint at http://69.48.229.140:8080 over plain HTTP. On npm install, the...

Malicious code in @prime0/alanced-match (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53d49bf28eb233bca0591b32c11b411d1c10b8e8f978d1b76c6df2e6a00772f3 The package @prime0/alanced-match is a 1-character-drop typosquat of balanced-match. Its postinstall.js runs automatically on npm install and POSTs a...

Malicious code in kartykp-prod-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d19ade9fc52be37e965196e092b50a392993e063804a7c67e91edc9af51a4007 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16196 Malicious code in chai-as-crack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21 Package's main entry index.js unconditionally requires./lib/config at top level, causing the file to execute on any require'chai-as-crack'...

MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...

MAL-2026-16192 Malicious code in strapi-plugin-weccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4a6e3de6177f265d44cf7317b020dbaed43907a0ed75b05ae0fe4eebaab469 The package's postinstall.js also declared as main executes automatically on npm install and performs bulk host reconnaissance and credential theft...

MAL-2026-16191 Malicious code in strapi-plugin-uicc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d393f18bab3c8fe1d9bea2d425d24d385657785e23cc053ac5e2c1c322f75129 postinstall.js is registered as both the npm postinstall hook and the package main. On install it polls os.hostname every 3 seconds and, when the...

MAL-2026-16187 Malicious code in strapi-plugin-revsh-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d4e28da86ccc1cb11bae22a247171657c958b6bf24b8bf4541bb08970c969b package.json declares scripts.postinstall = "node postinstall.js", causing postinstall.js to run automatically on npm install. That file executes bas...