@0xwork/connect (>=0.1.0, <=0.1.8), @chrysb/alphaclaw (>=0.9.10, <=0.9.16) +6 more potentially affected by CVE-2026-62227 via openclaw (>=2026.4.21, <=2026.5.24-beta.2)

openclaw NPM version =2026.4.21, =0.1.0, =0.9.10, =2.2.4, =4.0.0, =0.0.0, =2.1.8, =0.1.38, =0.0.1, =0.3.0 Source cves: CVE-2026-62227 Source advisory: SNYK:JS-OPENCLAW-18017823...

@0xwork/connect (>=0.1.0, <=0.1.9), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +28 more potentially affected by CVE-2026-62228 via openclaw (>=2026.3.22, <=2026.6.1)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-62228 Source advisory: SNYK:JS-OPENCLAW-18017821...

@nohost/server (>=0.0.1-beta2, <=0.3.6) potentially affected by CVE-2026-55629 via whistle (>=2.3.7, <=2.9.85-beta)

whistle NPM version =2.3.7, =0.0.1-beta2, =0.3.6 Source cves: CVE-2026-55629 Source advisory: SNYK:JS-WHISTLE-18601847...

@alphasense/sdk-cli (>=0.0.4, <=1.0.4), @bsmnt/sdk-gen (2.0.5) +1 more potentially affected by CVE-2026-63397 via @genql/cli (>=6.0.0, <=6.3.3)

@genql/cli NPM version =6.0.0, =0.0.4, =0.0.2, =3.1.10 Source cves: CVE-2026-63397 Source advisory: OSV:GHSA-W757-XVVV-VGFW...

MAL-2026-10708 Malicious code in @aicommander/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a0d4917f10db91a59e47821bfa2399801219a85da0a59b8596d85fd3931fc93 @aicommander/agent installs a remote-machine agent that opens an outbound WebSocket to the hardcoded relay https://aicommander.dev and executes shell...

MAL-2026-10728 Malicious code in bvm-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87ff2c7d903c5594ba5fa2e11d3fe6281380a5f2d010a1a0e3c0679464ab1fca dist/index.js in [email protected] imports childprocess and issues fetch calls to the hardcoded host https://bvm-core.nexsail.top at the top of the...

MAL-2026-10747 Malicious code in sensorium-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73c4ac95caf91cb047bab32d5202efa2dfc2e4f84a032160419a7c30739da91c sensorium-mcp starts a background poller against api.telegram.org/getUpdates and delivers received message text as prompts to locally spawned Claude...

Malicious code in @agent-link/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912 The package's runtime connects to a hardcoded WebSocket relay default wss://msclaude.ai and dispatches messages received from that relay directly int...

@whalent/agent (0.3.249) potentially affected by unknown CVE via @whalent/agent-core (0.3.249)

@whalent/agent-core NPM version 0.3.249 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.249 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.265) potentially affected by unknown CVE via @whalent/agent-core (0.3.265)

@whalent/agent-core NPM version 0.3.265 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.265 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.248) potentially affected by unknown CVE via @whalent/agent-core (0.3.248)

@whalent/agent-core NPM version 0.3.248 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.248 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.245) potentially affected by unknown CVE via @whalent/agent-core (0.3.245)

@whalent/agent-core NPM version 0.3.245 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.245 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.280) potentially affected by unknown CVE via @whalent/agent-core (0.3.280)

@whalent/agent-core NPM version 0.3.280 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.280 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.258) potentially affected by unknown CVE via @whalent/agent-core (0.3.258)

@whalent/agent-core NPM version 0.3.258 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.258 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.289) potentially affected by unknown CVE via @whalent/agent-core (0.3.289)

@whalent/agent-core NPM version 0.3.289 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.289 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.232) potentially affected by unknown CVE via @whalent/agent-core (0.3.232)

@whalent/agent-core NPM version 0.3.232 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.232 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.238) potentially affected by unknown CVE via @whalent/agent-core (0.3.238)

@whalent/agent-core NPM version 0.3.238 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.238 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.240) potentially affected by unknown CVE via @whalent/agent-core (0.3.240)

@whalent/agent-core NPM version 0.3.240 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.240 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.254) potentially affected by unknown CVE via @whalent/agent-core (0.3.254)

@whalent/agent-core NPM version 0.3.254 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.254 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.263) potentially affected by unknown CVE via @whalent/agent-core (0.3.263)

@whalent/agent-core NPM version 0.3.263 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.263 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...