Malicious code in @mohamed_nowisar/depconf-canary-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078a8dc3351eb44ee9ff0d5992b9082b726d7fbce0152ae2d44595a9e279ef82 On npm install, the package's preinstall hook runs node beacon.js, which collects host identity os.hostname, os.userInfo.username, process.cwd,...

Malicious code in agora402-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...

Malicious code in mtslink-depconf-probe-profileusername (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f679922753b7a59c59af851ae74275b5d4760b13fc516bc8c68e8e9568393dc6 Package ships an empty index.js and a preinstall lifecycle script that performs a DNS lookup against probe.4otph6fase1x2won0hrfzul2wt2qqge5.oastify.c...

ROOT-APP-NPM-CVE-2026-33151 CVE-2026-33151 in socket.io-parser - Patched by Root

Root has patched CVE-2026-33151 in the socket.io-parser package for Root:npm. Multiple fixed versions available...

NPM: MagicMirror: ssrf calendar .js

NPM: MagicMirror: ssrf calendar .js vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

ROOT-APP-NPM-CVE-2026-47698 CVE-2026-47698 in vm2 - Patched by Root

Root has patched CVE-2026-47698 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-47686 CVE-2026-47686 in vm2 - Patched by Root

Root has patched CVE-2026-47686 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-H25M-26QC-WCJF GHSA-h25m-26qc-wcjf in next - Patched by Root

Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available...

Malicious code in sui-move-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760bce82610adadda6538b9ab04627b71b66c3816fe63f8e1a8f629ce4b4aaf4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

NPM: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

NPM: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth vulnerability discovered by ? in WordPress Npm mlflow versions 3.15.0...

NPM: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

NPM: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

NPM: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

NPM: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...

Malicious code in sui-move-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cceb15de1ddd23a55de69afe59a00c79dcc23f8ce3dfed33592d781bddfbb5a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs

NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs vulnerability discovered by ? in WordPress Npm deepmerge-ts versions 8.0.0...

CVE-2026-19693 extract-zip arbitrary file write outside the destination directory via a symlink at the final path component

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

Malicious code in sugarball-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14106 Malicious code in cloud-agen-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...

Malicious code in a.poltoradnev-package-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d1659d9d1386305bd1c623cc2e3643375f4e14ad279ece4f3df684ecd53ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...