MAL-2026-10983 Malicious code in svelte-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de19bce1fef8c7cc16b9066720070e2181816e07551ecd8435baea09c607ed6 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicative of credential theft, install-time code executio...

NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter

NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, = 2.4.2...

Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...

MAL-2026-10984 Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: prism, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, kubeflow-centraldashboard, npm, opensearch-dashboards, pulumi, homepage, lerna, wazuh-dashboard-fips, graalvm, gitlab-rails-ce-fips, saf, kibana, opensearch-dashboards-fips, actions-runner...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: prism, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, kubeflow-centraldashboard, npm, opensearch-dashboards, pulumi, homepage, lerna, wazuh-dashboard-fips, graalvm, gitlab-rails-ce-fips, saf, kibana, opensearch-dashboards-fips, actions-runner...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: prism, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, kubeflow-centraldashboard, npm, opensearch-dashboards, pulumi, lerna, wazuh-dashboard-fips, graalvm, gitlab-rails-ce-fips, saf, kibana, opensearch-dashboards-fips, actions-runner...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: prism, gitlab-rails-ce, sqlpad, wazuh-dashboard, code-server, kubeflow-centraldashboard, npm, opensearch-dashboards, pulumi, homepage, lerna, wazuh-dashboard-fips, graalvm, gitlab-rails-ce-fips, saf, kibana, opensearch-dashboards-fips, actions-runner...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: pulumi, saf, code-server, npm, sqlpad, prism, lerna, kubeflow-centraldashboard...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: pulumi, saf, code-server, npm, sqlpad, prism, lerna, kubeflow-centraldashboard...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: pulumi, saf, code-server, npm, sqlpad, prism, lerna, kubeflow-centraldashboard...

ROOT-APP-NPM-AIKIDO-2026-10689 AIKIDO-2026-10689 in @rootio/vm2 - Patched by Root

Root has patched AIKIDO-2026-10689 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44003 CVE-2026-44003 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-44003 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10841 AIKIDO-2026-10841 in @rootio/vm2 - Patched by Root

Root has patched AIKIDO-2026-10841 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-24118 CVE-2026-24118 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-24118 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

MAL-2026-10968 Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...

MAL-2026-10966 Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...

MAL-2026-10971 Malicious code in cxpw-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2288ef5dfb841556f7ba4907a025270dfda3439820215b7d98e644afca78a306 cxpw-offers ships an empty index.js and declares its only dependency ltidisafe as a direct tarball URL at...

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.16...