235880 matches found
ROOT-APP-NPM-CVE-2026-44290 CVE-2026-44290 in protobufjs - Patched by Root
Root has patched CVE-2026-44290 in the protobufjs package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44289 CVE-2026-44289 in protobufjs - Patched by Root
Root has patched CVE-2026-44289 in the protobufjs package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-45740 CVE-2026-45740 in protobufjs - Patched by Root
Root has patched CVE-2026-45740 in the protobufjs package for Root:npm. Multiple fixed versions available...
MAL-2026-11430 Malicious code in list-issue-predecessor-dependencies-block (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f74d699bfc5fcf83c6f2864f93ecd41d3d9f8613f45f6bfb3b6dd5eeb7a880e The OpenSSF Package Analysis project identified 'list-issue-predecessor-dependencies-block' @ 99.0.0 npm as malicious. It is considered maliciou...
MAL-2026-11427 Malicious code in pp-react-worldready (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6a0cb104ba7e29ae2e20cb4d191f5a1cb0a74de3a26cc06e9e6369d5bbee94e5 The OpenSSF Package Analysis project identified 'pp-react-worldready' @ 1.0.0 npm as malicious. It is considered malicious because: - The packag...
MAL-2026-11455 Malicious code in allurectl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81cc68a7fe1c39ad33325aeb049148b1165f9d8d85c14329094de9912305e325 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51e3c940b9fc50ad864429da89bf924d2bd1c0253ac8bde66b0b82643260eb51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11458 Malicious code in chaos-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f921c394df64d1bceae64ceeb12704fa1a6bec8e502a93507aae663647af05e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11460 Malicious code in create-remotion (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f64eaf9a8b1571d5e5800922eededf88e925355ce9fa4d61c60d8b8c302401b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11462 Malicious code in fast-csv-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca3596032239f2a982b11e2846e8af25975d77f3f7c211a32f68e5a451ead883 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-11454 Malicious code in ai-backup-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 647eefd97b5d8a0eac0be938122ebe0120152f6ded442d7616b18707bd26ea65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
NPM: hashi-vault-js has a path traversal and query parameter injection
NPM: hashi-vault-js has a path traversal and query parameter injection vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...
NPM: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
NPM: re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...
Malicious code in @goodjavascript/dotenv (npm)
@goodjavascript/[email protected] published 2025-03-22T09:05:32Z, replaced by an npm 0.0.1-security holding stub 2026-07-30T22:47:55Z — approximately 16 months live is a two-file package that impersonates the API of the widely used dotenv configuration loader while running a command-and-control implan...
MAL-2026-11270 Malicious code in create-backend-scaffold (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f749e8b76ccc1619cfe98769cfcc133208c515f14ed198115a55587b28a49951 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
ROOT-APP-NPM-GHSA-CMWH-PVXP-8882 GHSA-cmwh-pvxp-8882 in @rootio/dompurify - Patched by Root
Root has patched GHSA-cmwh-pvxp-8882 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-6734 CVE-2026-6734 in @rootio/undici - Patched by Root
Root has patched CVE-2026-6734 in the @rootio/undici package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-9679 CVE-2026-9679 in @rootio/undici - Patched by Root
Root has patched CVE-2026-9679 in the @rootio/undici package for Root:npm. Multiple fixed versions available...