235858 matches found
MAL-2026-6328 Malicious code in @muaththir/api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66954b91179d60bfbf1c18e8ed8ed9e6b12ab7b13bc6ab2a4174c3bf063c2c0a On npm install, the package's preinstall lifecycle hook runs node index.js, which collects host identifiers os.userInfo.username, process.cwd, Node...
MAL-2026-6330 Malicious code in @ravespaceio/rave-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4744e569e605ac6d749c8611417ad75dfd4d32f30fb6a75d5bcfa211d126bbd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6329 Malicious code in @ravespaceio/browser-input (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4814ac9a416bc2053c14cc597f4587bca639c752bba54c8429c4be9b49f3137b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in parket-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9b185a1b54e41a8fb900a67aab43dbb78abc4fea96e9ca05d356f6864e3bdd index.js imports childprocess and invokes execSync with bash and zsh shells index.js line 1, 301, 317. Without traced execution context it is not...
MAL-2026-6334 Malicious code in parket-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9b185a1b54e41a8fb900a67aab43dbb78abc4fea96e9ca05d356f6864e3bdd index.js imports childprocess and invokes execSync with bash and zsh shells index.js line 1, 301, 317. Without traced execution context it is not...
MAL-2026-6298 Malicious code in ttal2ttml (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29387ac35a2248ad2e4b287b8c082f8d1a8d03b4937fc84a5b81fb85697e19d4 package.json declares a preinstall lifecycle script that runs node -e "tryrequire'childprocess'.execSync'curl -sf...
Malicious code in new-solt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a46a9516de2c87a2d451b78ace7033fb9dffa9faa4216b84eb068136098cfa Package [email protected] contains index.js which imports childprocess and invokes execSync with bash and zsh shell strings around lines 315 and 331...
MAL-2026-6287 Malicious code in poly-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5aab464aac47233efb564c52d5818fef783efa856f8318c61d61ef99ca0da4e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in new-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47f6e9bcab53d95265012a31a4dcfc1485ed6db858e788e68ac2ac1ebc33fc34 index.js imports childprocess and contains execSync calls invoking bash and zsh around lines 301 and 317. Without traced execution context, it is not...
Malicious code in poly-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5aab464aac47233efb564c52d5818fef783efa856f8318c61d61ef99ca0da4e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in new-ecro-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0826d146dbc513ac14f403eaa9ba65dffbd04da52c55ff1840ad153dab96e87 The package publishes verbatim big.js v7.0.1 source including the upstream copyright header, README, repository URL pointing to MikeMcl/big.js, and t...
Malicious code in libsignal-node-travatiger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311b53330c1d8c3546d0b4fa3d460ca694fc20d60608ac5a276f40f7a73279fa On require of this package, index.js schedules install.js which locates @whiskeysockets/baileys in the installer's nodemodules tree searching...
GHSA-G8M3-5G58-FQ7M vulnerabilities
Vulnerabilities for packages: saf, prism, actions-runner, npm, code-server, haraka, node-gyp, renovate, kibana, py3-captum, pelias-api, vitess, gemini-cli...
GHSA-P88M-4JFJ-68FV vulnerabilities
Vulnerabilities for packages: saf, prism, actions-runner, npm, code-server, haraka, node-gyp, renovate, kibana, py3-captum, pelias-api, vitess, gemini-cli...
CVE-2026-9679 vulnerabilities
Vulnerabilities for packages: saf, prism, actions-runner, npm, code-server, haraka, node-gyp, renovate, kibana, py3-captum, pelias-api, vitess, gemini-cli...
GHSA-35P6-XMWP-9G52 vulnerabilities
Vulnerabilities for packages: saf, prism, actions-runner, npm, code-server, haraka, node-gyp, renovate, kibana, py3-captum, pelias-api, vitess, gemini-cli...
CVE-2026-6733 vulnerabilities
Vulnerabilities for packages: saf, prism, actions-runner, npm, code-server, haraka, node-gyp, renovate, kibana, py3-captum, pelias-api, vitess, gemini-cli...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: saf, prism, actions-runner, npm, code-server, haraka, node-gyp, renovate, kibana, py3-captum, pelias-api, vitess, gemini-cli...
CVE-2026-11525 vulnerabilities
Vulnerabilities for packages: saf, prism, actions-runner, npm, code-server, haraka, node-gyp, renovate, kibana, py3-captum, pelias-api, vitess, gemini-cli...
MAL-2026-6278 Malicious code in ts-wross (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dae43b7ff77748f10ae5faf6d87b7d63552e5629a37c931ea2c0de3539b469 Package is published under the name ts-wross but its package.json claims authorship by Michael Mclaughlin [email protected] and points its repository...