ROOT-APP-NPM-CVE-2026-45740 CVE-2026-45740 in protobufjs - Patched by Root

Root has patched CVE-2026-45740 in the protobufjs package for Root:npm. Multiple fixed versions available...

MAL-2026-11430 Malicious code in list-issue-predecessor-dependencies-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f74d699bfc5fcf83c6f2864f93ecd41d3d9f8613f45f6bfb3b6dd5eeb7a880e The OpenSSF Package Analysis project identified 'list-issue-predecessor-dependencies-block' @ 99.0.0 npm as malicious. It is considered maliciou...

MAL-2026-11455 Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81cc68a7fe1c39ad33325aeb049148b1165f9d8d85c14329094de9912305e325 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51e3c940b9fc50ad864429da89bf924d2bd1c0253ac8bde66b0b82643260eb51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11458 Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f921c394df64d1bceae64ceeb12704fa1a6bec8e502a93507aae663647af05e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11454 Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 647eefd97b5d8a0eac0be938122ebe0120152f6ded442d7616b18707bd26ea65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NPM: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

NPM: re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...

ROOT-APP-NPM-CVE-2026-6734 CVE-2026-6734 in @rootio/undici - Patched by Root

Root has patched CVE-2026-6734 in the @rootio/undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9679 CVE-2026-9679 in @rootio/undici - Patched by Root

Root has patched CVE-2026-9679 in the @rootio/undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-53655 CVE-2026-53655 in @rootio/tar - Patched by Root

Root has patched CVE-2026-53655 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-23745 CVE-2026-23745 in @rootio/tar - Patched by Root

Root has patched CVE-2026-23745 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-CB11602 Security fixes in npm 11.18.0-r0

Package npm version 11.18.0-r0 fixes 1 vulnerabilities: CVE-2026-13149...

CLEANSTART-2026-TH02378 Security fixes in npm 11.14.0-r4

Package npm version 11.14.0-r4 fixes 8 vulnerabilities: ghsa-vxpw-j846-p89q, ghsa-p88m-4jfj-68fv, ghsa-g8m3-5g58-fq7m, ghsa-35p6-xmwp-9g52, CVE-2026-12151...

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than...

ROOT-APP-NPM-CVE-2026-44496 CVE-2026-44496 in @rootio/axios - Patched by Root

Root has patched CVE-2026-44496 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in @rootio/axios - Patched by Root

Root has patched CVE-2026-44489 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

MAL-2026-11131 Malicious code in basic-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...

MAL-2026-11108 Malicious code in string-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 752f3e4fded6d0546e00af595793134c025fd4afd8ee6d8188e0146a608b1cfb The OpenSSF Package Analysis project identified 'string-format-kit' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in riskunifiedgatewayserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 832cecce176cee15be4875642bd875636a40159560e29bd359746b2c80359e10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in identityauthorizationserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef1d43e872519f6b1865d149c6f202e9079165bc28c12645e8154155d61e7455 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...