@apicity/mcp-server (0.8.5) potentially affected by unknown CVE via @apicity/meta (0.8.5)

@apicity/meta NPM version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.5 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.4) potentially affected by unknown CVE via @apicity/meta (0.8.4)

@apicity/meta NPM version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.4 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.2) potentially affected by unknown CVE via @apicity/meta (0.8.2)

@apicity/meta NPM version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.6) potentially affected by unknown CVE via @apicity/meta (0.8.6)

@apicity/meta NPM version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.6 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.8) potentially affected by unknown CVE via @apicity/meta (0.8.8)

@apicity/meta NPM version 0.8.8 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.8 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.3) potentially affected by unknown CVE via @apicity/meta (0.8.3)

@apicity/meta NPM version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

MAL-2026-13412 Malicious code in @apicity/meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76d2a899fc3db1427439c97acc4a873277804f6c771d524a3b93b70ff533581 dist/src/example.js at line 12 contains a reference to litter.catbox.moe, an anonymous mutable file-hosting service used as a second-stage payload ho...

Malicious code in agenttunnels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1 agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker agenttunnels-session.lakshman111.workers.dev...

MAL-2026-13400 Malicious code in agenttunnels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1 agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker agenttunnels-session.lakshman111.workers.dev...

Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

MAL-2026-13403 Malicious code in streak-cache-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135 The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a...

Malicious code in jagproject (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...

MAL-2026-13402 Malicious code in jagproject (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode... arrays that decode to https://fiora.nixel.my.id/...

ROOT-APP-NPM-CVE-2019-5413 CVE-2019-5413 in morgan - Patched by Root

Root has patched CVE-2019-5413 in the morgan package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2015-9235 CVE-2015-9235 in jsonwebtoken - Patched by Root

Root has patched CVE-2015-9235 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-NSWG-ECO-17 NSWG-ECO-17 in jsonwebtoken - Patched by Root

Root has patched NSWG-ECO-17 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...

Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

MAL-2026-13389 Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

MAL-2026-13388 Malicious code in @simplipayng/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ead1207956df050d2746ae899d5ea9132fbc4c35684f9e992599c5ef10259c The bundled main dist/index.js executes an evalatob... blob at module top level, so any Node-side require of the package SSR, tests, Next.js server...

Malicious code in svelte-mapping-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76203390ecd481ea969ede1996712ca380655fb041c051d50696b2f8f3dd9265 No a static rule matches and no traced code paths indicating credential access, exfiltration, install-time remote code execution, silent-relay,...