Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86481ee3f08109eeaec60a41afb7c2e8d03efd680cc5bf846bdc342ec4205205 The package advertises itself as a high-throughput bulk-mail tool and ships every one of its 50 JS files cli.js, denv.js, helpers.js, all commands/.j...

Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...

Malicious code in vectormark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0646473c841676e2f55d66494a805943e00b2e2d7515e1bbba5453e6a9024e [email protected] advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function getPlugin that issues an...

MAL-2026-10983 Malicious code in svelte-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de19bce1fef8c7cc16b9066720070e2181816e07551ecd8435baea09c607ed6 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicative of credential theft, install-time code executio...

NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter

NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, = 2.4.2...

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...

MAL-2026-10984 Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: sqlpad, actions-runner, gitlab-rails-ce, npm, wazuh-dashboard-fips, kubeflow-centraldashboard, wazuh-dashboard, prism, pulumi, saf, lerna, kibana, homepage, opensearch-dashboards-fips, gitlab-rails-ce-fips, graalvm, code-server, opensearch-dashboards...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: sqlpad, actions-runner, gitlab-rails-ce, npm, wazuh-dashboard-fips, kubeflow-centraldashboard, wazuh-dashboard, prism, pulumi, saf, lerna, kibana, homepage, opensearch-dashboards-fips, gitlab-rails-ce-fips, graalvm, code-server, opensearch-dashboards...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: sqlpad, actions-runner, gitlab-rails-ce, npm, wazuh-dashboard-fips, kubeflow-centraldashboard, wazuh-dashboard, prism, pulumi, saf, lerna, kibana, homepage, opensearch-dashboards-fips, gitlab-rails-ce-fips, graalvm, code-server, opensearch-dashboards...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: sqlpad, actions-runner, gitlab-rails-ce, npm, wazuh-dashboard-fips, kubeflow-centraldashboard, wazuh-dashboard, prism, pulumi, saf, lerna, kibana, opensearch-dashboards-fips, gitlab-rails-ce-fips, graalvm, code-server, opensearch-dashboards...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: pulumi, code-server, npm, lerna, sqlpad, saf, kubeflow-centraldashboard, prism...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: pulumi, code-server, npm, lerna, sqlpad, saf, kubeflow-centraldashboard, prism...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: pulumi, code-server, npm, lerna, sqlpad, saf, kubeflow-centraldashboard, prism...

ROOT-APP-NPM-CVE-2026-44003 CVE-2026-44003 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-44003 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10689 AIKIDO-2026-10689 in @rootio/vm2 - Patched by Root

Root has patched AIKIDO-2026-10689 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10841 AIKIDO-2026-10841 in @rootio/vm2 - Patched by Root

Root has patched AIKIDO-2026-10841 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-24118 CVE-2026-24118 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-24118 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

MAL-2026-10968 Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...