ROOT-APP-NPM-CVE-2026-41650 CVE-2026-41650 in @rootio/fast-xml-parser - Patched by Root

Root has patched CVE-2026-41650 in the @rootio/fast-xml-parser package for Root:npm. Multiple fixed versions available...

Malicious code in polymarket-trading-developer-tools (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-trading-developer-tools uses a dropper technique: a postinstall hook downloads configuration from pm-trading-dev-tools-be.vercel.app and exfiltrates data to the...

MAL-2026-6690 Malicious code in log-taker1 (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. log-taker1 embeds a full infostealer 2800 lines directly in index.js, executed at install time via postinstall: node test.js. The payload harvests cryptocurrency wallet vaults MetaMask, Phantom, Solflare,...

Malicious code in decimal-format-core (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. decimal-format-core uses a dropper technique: a postinstall hook executes scripts/install-check.cjs at install time, which fetches a second-stage infostealer payload from the C2 domain logstream-api.online...

Malicious code in thirdwb (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. thirdwb is a typosquat of the legitimate thirdweb package. It uses a side-loader technique, pulling in log-taker as a transitive dependency; the infostealer runs automatically via that dependency's...

MAL-2026-6688 Malicious code in console-fmt-cli (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. console-fmt-cli uses a side-loader technique: it declares decimal-format-core =3.0 as a dependency, which contains a dropper that executes at install time via a postinstall hook. The dropper fetches a...

MAL-2026-6692 Malicious code in polymarket-trading-developer-tools (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-trading-developer-tools uses a dropper technique: a postinstall hook downloads configuration from pm-trading-dev-tools-be.vercel.app and exfiltrates data to the...

MAL-2026-6694 Malicious code in thirdwebb (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. thirdwebb is a typosquat of the legitimate thirdweb package. It uses a side-loader technique, pulling in log-taker as a transitive dependency; the infostealer runs automatically via that dependency's...

@chargeover/strapi (0.0.1-rc1.1), @code-mancers/strapi-plugin-stellate (>=1.0.0, <=1.4.3) +34 more potentially affected by CVE-2026-57997 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=5.42.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =0.1.1, =0.0.1, =0.1.0, =0.1.4 - cypherscan-strapi 0.1.1 - devlaunchers-strapiv4 0.1.0 - easylaser-vn-cms 0.1.0 - medusa-outerspace-plugin-strapi 1.0.0-beta.8 and more Source cves: CVE-2026-57997...

Malicious code in @concerns/i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b727ee2cbb3fadb59ee0ec7febb6db24f25e775ee3957c6765800a61de44289f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6605 Malicious code in @bscom/styling (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b4a6eb2b93e7ac0b6e45f2cc44f23127ef61b7d605b6c64f6bcbc58bdbe4543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @contentprod-authoring/block-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa028931eef026447363bc2ef44ace207f4f3226de4289e354d26d730fa28186 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @appsource/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c331702ce64d0b03690c358afdf91a71ebfd87cccde0e69fd6934a690210cfc3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @alerts/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a825df408053d3df39c8fe0790b9e99ef97e51f60765549e1931709b86fcf30b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6649 Malicious code in @sixt-payment/form-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d313848c4f3389f9778f070aa4c9a198c6cc7e5eb4b9a56b3d3d7cf87569d3c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bscom/styling (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b4a6eb2b93e7ac0b6e45f2cc44f23127ef61b7d605b6c64f6bcbc58bdbe4543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6601 Malicious code in @appsource/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c331702ce64d0b03690c358afdf91a71ebfd87cccde0e69fd6934a690210cfc3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6615 Malicious code in @digitalpharmacist/http-error-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd3874246d23d6027bd09962515c8e79a0246740ff5fc6f853270c0a40271d18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6638 Malicious code in @postidigital-feature/oneaccount-orgadmin-front (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4060c39db80353eb81ccea4c782c16b519931e13da0c78633fabd465d31df052 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6651 Malicious code in @tbe-ui/ides (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb1396e277691530f1b9a5a14342e1241fe233ecf516574059f34f8df36dca61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...