@36node/auth-sdk (>=1.1.1-pr-7-1d68cf28da, <=2.28.0), @7nohe/openapi-react-query-codegen (>=0.0.0-13d458778df8db161111e788ed4207a13a110724, <=2.1.0) +139 more potentially affected by CVE-2026-48819 via @hey-api/openapi-ts (>=0.43.0, <=0.96.1)

@hey-api/openapi-ts NPM version =0.43.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.0.0, =0.7.1, =0.0.1, =1.0.0, =0.0.12, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1-react-native, =0.0.763 and more Source cves: CVE-2026-48819 Source advisory:...

@36node/auth-sdk (>=1.1.1-pr-7-1d68cf28da, <=2.28.0), @7nohe/openapi-react-query-codegen (>=0.0.0-13d458778df8db161111e788ed4207a13a110724, <=2.1.0) +139 more potentially affected by CVE-2026-48819 via @hey-api/openapi-ts (>=0.43.0, <=0.96.1)

@hey-api/openapi-ts NPM version =0.43.0, =1.1.1-pr-7-1d68cf28da, =0.0.0-13d458778df8db161111e788ed4207a13a110724, =1.0.0, =0.7.1, =0.0.1, =1.0.0, =0.0.12, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.0, =0.0.1-react-native, =0.0.763 and more Source cves: CVE-2026-48819 Source advisory:...

Malicious code in test-pkg-pnpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo...

Malicious code in test-pkg-x0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d0014944456f668a25fa484bf7cb5f36a7128d6a585b86d9294d8d49b23049a Package declares scripts.postinstall pointing at shim.js, a script that runs unconditionally on npm install. shim.js branches on uname -s...

MAL-2026-6713 Malicious code in polymarket-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65aa9243f492d222e1bb036c8ed55fb17268bd987a63ad2ea2aa1b28e44defc3 Package is published as a Polymarket API client but its default export getPlugin performs unconditional remote code execution on use. On invocation i...

MAL-2026-6714 Malicious code in polymarket-trading-developer-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...

Malicious code in polymarket-risk-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54bfddce038bb64117d6850bb2977f8cee17704212e12e6214fb495b9d4cee79 On npm install, the package's postinstall script reads a config URL from package.json's homepage field...

NPM: sigstore's `certificateOIDs` verification constraints are silently dropped and never enforced

NPM: sigstore's certificateOIDs verification constraints are silently dropped and never enforced vulnerability discovered by ? in WordPress Npm sigstore versions = 4.1.0...

@cyruslabs/install (>=0.1.0-alpha.6, <=0.1.0-alpha.12), @zantarix/cursus (>=0.3.0, <=0.5.0) potentially affected by CVE-2026-48815 via sigstore (>=4.0.0, <=4.1.0)

sigstore NPM version =4.0.0, =0.1.0-alpha.6, =0.3.0, =0.5.0 Source cves: CVE-2026-48815 Source advisory: SNYK:JS-SIGSTORE-17817054...

@donmai/core (>=0.9.0, <=0.9.5), @donmai/mcp-server (>=0.9.0, <=0.9.5) +14 more potentially affected by CVE-2026-48815 via @sigstore/verify (>=3.0.0, <=3.1.0)

@sigstore/verify NPM version =3.0.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.1.1, =0.0.0, =0.0.4 and more Source cves: CVE-2026-48815 Source advisory: SNYK:JS-SIGSTOREVERIFY-17817052...

@cyruslabs/install (>=0.1.0-alpha.6, <=0.1.0-alpha.12), @zantarix/cursus (>=0.3.0, <=0.5.0) potentially affected by CVE-2026-48815 via sigstore (>=4.0.0, <=4.1.0)

sigstore NPM version =4.0.0, =0.1.0-alpha.6, =0.3.0, =0.5.0 Source cves: CVE-2026-48815 Source advisory: OSV:GHSA-52V5-JR5W-GJXR...

@donmai/core (>=0.9.0, <=0.9.5), @donmai/mcp-server (>=0.9.0, <=0.9.5) +8 more potentially affected by CVE-2026-48816 via @sigstore/verify (3.1.0)

@sigstore/verify NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sigstore/verify and may be impacted: - @donmai/core =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.66 Source cves:...

@donmai/core (>=0.9.0, <=0.9.5), @donmai/mcp-server (>=0.9.0, <=0.9.5) +8 more potentially affected by CVE-2026-48816 via @sigstore/verify (3.1.0)

@sigstore/verify NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sigstore/verify and may be impacted: - @donmai/core =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.66 Source cves:...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49988 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49988 Source advisory: OSV:GHSA-HWPP-H97W-2H3J...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49988 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49988 Source advisory: SNYK:JS-REPOMIX-17817051...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49987 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49987 Source advisory: SNYK:JS-REPOMIX-17817038...

MAL-2026-6706 Malicious code in hardhat-plugin-solidity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cc8113c50400572d998811dd026bbf516ce819cf93bc283770d55ac00b142 Package published as 'hardhat-plugin-solidity' impersonates prettier-plugin-solidity: package.json sets the unrelated 'hardhat-plugin-' name while...

MAL-2026-6708 Malicious code in zyncmap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a65a1106fa2bab6eb0b5982b289665b4b96a6ad86769a867f6e62fb73663f77 [email protected] advertises itself as an SVG sanitization/minification utility, but index.js exports an undocumented function getPlugin that, when...

Malicious code in svgson-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ceb1026a96918a3f4ed4c7c4f0aa75411c3869f1ad14405174e396b4e67907d2 index.js exports an undocumented getPlugin function which, when invoked, performs an HTTP GET to https://shorturl.at/147uq, JSON-parses the response...

MAL-2026-6791 Malicious code in npm-show-date-proof-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 884f2797ddf6247c906bb97e72b3c0891551b260980811d50c7211ab2ea0bbcf The package's postinstall.js runs on every npm install and collects the installer's username via whoami and os.userInfo, hostname os.hostname, platfo...