131242 matches found
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as "tensorlake," a TypeScript software development kit SDK for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credential...
CLEANSTART-2026-EE28153 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
Security vulnerability affects the npm package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...
CLEANSTART-2026-BJ83966 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
Security vulnerability affects the npm package. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript...
CLEANSTART-2026-ZC15270 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it
Security vulnerability affects the npm package. PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it...
MAL-2026-17665 Malicious code in animatecss-tailwind-adapter (npm)
animatecss-tailwind-adapter 2.0.6 was published to npm on 2026-07-28 by the account grant587holloway. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment...
MAL-2026-17666 Malicious code in animatecss-tailwind-bridge (npm)
animatecss-tailwind-bridge 2.0.6 was published to npm on 2026-09-13 by the account bennetwild. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...
MAL-2026-17667 Malicious code in tailwind-animatecss-uniform (npm)
tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...
ROOT-APP-NPM-CVE-2026-75975 CVE-2026-75975 in fast-uri - Patched by Root
Root has patched CVE-2026-75975 in the fast-uri package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-MMX7-HFXF-JPPX GHSA-mmx7-hfxf-jppx in axios - Patched by Root
Root has patched GHSA-mmx7-hfxf-jppx in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-MWF2-3PR3-8698 GHSA-mwf2-3pr3-8698 in axios - Patched by Root
Root has patched GHSA-mwf2-3pr3-8698 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-42H9-826W-CGV3 GHSA-42h9-826w-cgv3 in axios - Patched by Root
Root has patched GHSA-42h9-826w-cgv3 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-7Q8Q-RJ6J-MHJQ GHSA-7q8q-rj6j-mhjq in axios - Patched by Root
Root has patched GHSA-7q8q-rj6j-mhjq in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-JQH4-M9W3-8HP9 GHSA-jqh4-m9w3-8hp9 in axios - Patched by Root
Root has patched GHSA-jqh4-m9w3-8hp9 in the axios package for Root:npm. Multiple fixed versions available...
CVE-2022-24434_POC
CVE-2022-24434 β PoC for Dicer This repository contains a Proof-of-Concept PoC for CVE-2022-24434 , a vulnerability affecting the Dicer npm package. PoC target version: 0.3.1 ensure the dicer code used is exactly v0.3.1 π Project Structure Make sure the directory is structured like this: . βββ...
CVE-2026-42089
CVE-2026-42089 A local package installation helper trusted caller-supplied package names too much. In yeoman-environment, missing generators could be installed without user confirmation, turning attacker-controlled project metadata into a package-install and code-execution path. Intro I found thi...
ROOT-APP-NPM-CVE-2026-75899 CVE-2026-75899 in fast-uri - Patched by Root
Root has patched CVE-2026-75899 in the fast-uri package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-67320 CVE-2026-67320 in axios - Patched by Root
Root has patched CVE-2026-67320 in the axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-PMV8-RQ9R-6J72 GHSA-pmv8-rq9r-6j72 in axios - Patched by Root
Root has patched GHSA-pmv8-rq9r-6j72 in the axios package for Root:npm. Multiple fixed versions available...