MAL-2026-6176 Malicious code in request-tracking-sqlite (npm)

The npm package request-tracking-sqlite published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6173 Malicious code in profiling-keychain (npm)

The npm package profiling-keychain published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6151 Malicious code in buildautomation-touch (npm)

The npm package buildautomation-touch published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

MAL-2026-6153 Malicious code in datapersistence-profiling (npm)

The npm package datapersistence-profiling published by npm user sproger, [email protected] is a deceptive React Native component and part of a coordinated 37-package campaign across two attacker-controlled domains surrprisingcoompanny.lol and barbellmate.xyz. On component mount it registers...

ROOT-APP-NPM-CVE-2026-33939 CVE-2026-33939 in @rootio/handlebars - Patched by Root

Root has patched CVE-2026-33939 in the @rootio/handlebars package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-7RX3-28CR-V5WH GHSA-7rx3-28cr-v5wh in @rootio/handlebars - Patched by Root

Root has patched GHSA-7rx3-28cr-v5wh in the @rootio/handlebars package for Root:npm. Multiple fixed versions available...

Malicious code in @mastra/voice-playai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 095ae6a310d12472e2f23394b600c1465acb4921d1ae78a38893ff567518437f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

ROOT-APP-NPM-CVE-2026-44728 CVE-2026-44728 in @rootio/babel__plugin-transform-modules-systemjs - Patched by Root

Root has patched CVE-2026-44728 in the @rootio/babelplugin-transform-modules-systemjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-4923 CVE-2026-4923 in @rootio/path-to-regexp - Patched by Root

Root has patched CVE-2026-4923 in the @rootio/path-to-regexp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-4926 CVE-2026-4926 in @rootio/path-to-regexp - Patched by Root

Root has patched CVE-2026-4926 in the @rootio/path-to-regexp package for Root:npm. Multiple fixed versions available...

MAL-2026-5998 Malicious code in @mastra/arize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9417097d18abea911925be99fa31e70127eac4dcbcb16fb9eb5f20155a6650 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/arize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a9417097d18abea911925be99fa31e70127eac4dcbcb16fb9eb5f20155a6650 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6045 Malicious code in @mastra/voice-elevenlabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f99d987467406ef04c81d4437451d8ba5f38649e85437a361470bb9fd94fbe53 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6044 Malicious code in @mastra/voice-deepgram (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c6269a96366ca5cb804b7078f3eb2d0306ac86335922e3b00a17db6426024c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/voice-aws-nova-sonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c109adf5a77f9ace07bb1f5ec93cd8d3464bf675b7a93abc5fdfd64669f0c75 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6043 Malicious code in @mastra/voice-aws-nova-sonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c109adf5a77f9ace07bb1f5ec93cd8d3464bf675b7a93abc5fdfd64669f0c75 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6046 Malicious code in @mastra/voice-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7a69b358b2f5ed11287ca744502237a1b6971aac05d462222656a70b5864b3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6048 Malicious code in @mastra/voice-openai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 636dbce2606cf797f51ebd7c7e76ee2154a1e00e61b734cef90f19ca02ad397c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/voice-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7a69b358b2f5ed11287ca744502237a1b6971aac05d462222656a70b5864b3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/daytona (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6f64aaa3f1a7153a8a1bcb09d5f37bf46cbd5855c6fbf2a2b07bdec3ff9d6b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...