CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: kibana, prism, graalvm, kubeflow-centraldashboard, opensearch-dashboards-fips, pulumi, npm, saf, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, actions-runner, gitlab-rails-ce-fips, lerna, wazuh-dashboard-fips...

CVE-2026-59873 vulnerabilities

Vulnerabilities for packages: kibana, prism, graalvm, kubeflow-centraldashboard, opensearch-dashboards-fips, pulumi, npm, saf, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, actions-runner, gitlab-rails-ce-fips, lerna, wazuh-dashboard-fips, homepage...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: lerna, saf, pulumi, code-server, kubeflow-centraldashboard, sqlpad, prism, npm...

CVE-2026-59871 vulnerabilities

Vulnerabilities for packages: lerna, saf, pulumi, code-server, kubeflow-centraldashboard, sqlpad, prism, npm...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

MAL-2026-10583 Malicious code in chalkdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619 chalkdev is a near-empty package index.js exports , 11-byte README whose sole runtime behavior is a postinstall hook that runs .init.js on npm instal...

MAL-2026-10590 Malicious code in openaiwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...

MAL-2026-10579 Malicious code in bimi-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo...

ROOT-APP-NPM-CVE-2026-31938 CVE-2026-31938 in @rootio/jspdf - Patched by Root

Root has patched CVE-2026-31938 in the @rootio/jspdf package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27606 CVE-2026-27606 in @rootio/rollup - Patched by Root

Root has patched CVE-2026-27606 in the @rootio/rollup package for Root:npm. Multiple fixed versions available...

Malicious code in @akshajrawat/plugin-repo-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 596ef9a9a6888c00110ee80e3633052ed89887a8465e9a5eaa824a81e5211e46 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @cw-ui/asio-neon-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd2366d31cefc8f66861e0e65c782a88c46dc9232d11d463a9fa2869c73dcaa On npm install, postinstall.js reads os.hostname and embeds it as a query parameter in a plain-HTTP GET to a bare IPv4 address...

MAL-2026-10551 Malicious code in elsisi-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4deec3de3ca46a57023580a81da870e3ce444a691ad6f42f5217abe206ef448a package.json declares preinstall and postinstall lifecycle scripts that invoke wget against https://webhook.site/d5968c3d-d0d7-46c4-9305-a726b24fce9c...

Malicious code in sight-bind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398788014436c7e95df3045f9b32398c3de46b8c9275c0437e44bda1dcb6cc00 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sync-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37fba87304c3a7ede2f03b87c89b49a3fb9b7f201befbaf79312da2cce65abc4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10561 Malicious code in dom-weave (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e8a695176c5bf53d1e63c28f3ecfe9038d831e2ad4e063de45a04252976bd9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10566 Malicious code in sight-bind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398788014436c7e95df3045f9b32398c3de46b8c9275c0437e44bda1dcb6cc00 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10568 Malicious code in sync-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37fba87304c3a7ede2f03b87c89b49a3fb9b7f201befbaf79312da2cce65abc4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10555 Malicious code in @codex2005/logger-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f14223b7d9b3039682e27372df81a552cc1b451a99d60d5ec79e0d4696a7b800 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10528 Malicious code in @vitets/vite-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf Package is published as @vitets/vite-ts and copies the legitimate Vite project's author Evan You, README, homepage vitejs.dev, and repository...