@abstraxn/signer-react (>=2.0.2, <=3.3.4), @account-kit/react (>=4.53.1-alpha.0, <=4.88.5) +694 more potentially affected by CVE-2026-59877 via protobufjs (>=7.5.0, <=7.6.4)

protobufjs NPM version =7.5.0, =2.0.2, =4.53.1-alpha.0, =4.15.0, =3.26.0, =0.1.0, =1.9.1, =2.1.7-alpha-2, =0.1.0, =1.0.0-canary.15, =0.0.2, =0.0.1, =0.0.0-experimental-02e44603-20260603, =0.0.0-experimental-02e44603-20260603, =1.1.0 and more Source cves: CVE-2026-59877 Source advisory:...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1156 more potentially affected by CVE-2026-59877 via protobufjs (>=8.0.0, <=8.6.5)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-59877 Source advisory: SNYK:JS-PROTOBUFJS-17900550...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +654 more potentially affected by CVE-2026-59879 via immutable (>=4.0.0, <=4.3.8)

immutable NPM version =4.0.0, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59879 Source advisory: SNYK:JS-IMMUTABLE-17900573...

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +142 more potentially affected by CVE-2026-59879 via immutable (>=5.0.0, <=5.1.6)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =9.1.1-ruixiang.1, =0.1.0, =1.0.6 and more Source cves: CVE-2026-59879 Source advisory: SNYK:JS-IMMUTABLE-17900573...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +916 more potentially affected by CVE-2026-59871 via tar (>=7.0.0, <=7.5.17)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59871 Source advisory: SNYK:JS-TAR-17909104...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +719 more potentially affected by CVE-2026-59895 via hono (>=4.0.0, <=4.12.26)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-59895 Source advisory: SNYK:JS-HONO-17900056...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +710 more potentially affected by CVE-2026-59897 via hono (>=4.3.6, <=4.12.26)

hono NPM version =4.3.6, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-59897 Source advisory: SNYK:JS-HONO-17900541...

@0xgraph/cli (>=0.0.1, <=0.2.1), @actra-development-oss/redux-persistable (>=2.0.0, <=3.0.0) +654 more potentially affected by CVE-2026-59880 via immutable (>=4.0.0, <=4.3.8)

immutable NPM version =4.0.0, =0.0.1, =2.0.0, =0.2.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.0.1, =0.11.8-rc.0, =0.1.0, =0.3.3 - @alfresco/adf-testing 6.0.0-A.2-8258 - @alys-chain/graph-alys-cli 0.88.0 and more Source cves: CVE-2026-59880 Source advisory: SNYK:JS-IMMUTABLE-17900558...

@alessiodf/core-chameleon (0.0.1), @arkecosystem/core (>=3.0.0-alpha.0, <=3.13.0) +142 more potentially affected by CVE-2026-59880 via immutable (>=5.0.0, <=5.1.6)

immutable NPM version =5.0.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =3.0.0-alpha.6, =3.9.0-rc.0, =3.0.0-alpha.0, =3.0.0-alpha.0, =9.1.1-ruixiang.1, =0.1.0, =1.0.6 and more Source cves: CVE-2026-59880 Source advisory: SNYK:JS-IMMUTABLE-17900558...

@activeboxes/piece-gmail (0.8.1), @activeboxes/piece-imap (0.2.10) +98 more potentially affected by CVE-2026-59887 via linkify-it (>=5.0.0, <=5.0.1)

linkify-it NPM version =5.0.0, =0.6.0, =0.2.6, =0.0.1, =2026.7.1, =1.0.0, =1.0.6 - @anjirauto/app-gmail 0.5.2 - @anjirauto/app-imap 0.2.3 - @anjirauto/piece-imap 0.2.3 - @autohive/cell-gmail 0.8.1 and more Source cves: CVE-2026-59887 Source advisory: SNYK:JS-LINKIFYIT-17901217...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2206 more potentially affected by CVE-2026-59892 via @opentelemetry/propagator-jaeger (>=2.0.0, <=2.8.0)

@opentelemetry/propagator-jaeger NPM version =2.0.0, =0.1.0, =0.1.0-dev.00aaa03, =0.1.1, =0.0.1, =0.0.53, =0.0.31, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.3.4-0, =1.9.0-1 and more Source cves: CVE-2026-59892 Source...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +20 more potentially affected by CVE-2026-59731 via astro (>=6.0.0-beta.1, <=6.4.6)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =0.22.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.12.1 - astro-crush 1.0.0 and more Source cves: CVE-2026-59731 Source advisory: SNYK:JS-ASTRO-17901336...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +916 more potentially affected by CVE-2026-59874 via tar (>=7.0.0, <=7.5.17)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59874 Source advisory: SNYK:JS-TAR-17909068...

@0xwork/connect (>=0.1.0, <=0.1.8), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +28 more potentially affected by CVE-2026-59261 via openclaw (>=2026.3.22, <=2026.5.27)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-59261 Source advisory: SNYK:JS-OPENCLAW-17905620...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2058 more potentially affected by CVE-2026-59725 via engine.io (>=4.1.1, <=6.6.6)

engine.io NPM version =4.1.1, =1.0.49, =1.0.0, =0.0.28, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =1.2.1, =15.0.0, =1.0.1, =1.0.2 - @aaronconway7/create-gatsby-app 1.0.0 - @accio-cms/gatsby-starter-accio 0.0.1 and more Source cves: CVE-2026-59725 Source advisory: SNYK:JS-ENGINEIO-17900543...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @activepieces/piece-ai (>=0.3.1, <=0.3.4) +401 more potentially affected by CVE-2026-59896 via hono (>=4.11.8, <=4.12.26)

hono NPM version =4.11.8, =0.1.8-fix.3, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.1.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.1, =0.0.1-alpha.0, =0.0.1-alpha.37 and more Source cves: CVE-2026-59896 Source advisory: SNYK:JS-HONO-17900542...

MAL-2026-7016 Malicious code in @vraksha/gh-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c867b4c68acc159dea1bbd580c5de3f3c9fef7bd1f54cd48a02c59631ffda12 On npm install, the package's postinstall hook runs index.js, which performs an HTTPS GET to https://http-logger-production.up.railway.app/payload,...

Malicious code in configration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3255dd4ea4a24b3e000f6a8aadb9a022bc9aed07507124a595dd42ef0b429d6e The package impersonates the pino logger README badges, module.exports.pino = middleware under a one-character-omission name configration vs...

Malicious code in next-locomotive-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a11400eaa7dd74b24610ec815438de047089be7005b94c37717fa2b6f916ab6 The package's declared postinstall script reads the installer's OS username via os.userInfo.username and the machine hostname via os.hostname, compos...

MAL-2026-6988 Malicious code in @vite-tab/tab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95af865d1cf7d45f2b4c2a73eebcfcd1a1a6aba9a36f33bf8256ef4d7235903c @vite-tab/tab republishes Vite's codebase under a different name while impersonating the upstream project: package.json declares bin: vite:...