236260 matches found
Malicious code in react-tabulix-extended (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...
MAL-2026-10983 Malicious code in svelte-streaks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de19bce1fef8c7cc16b9066720070e2181816e07551ecd8435baea09c607ed6 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicative of credential theft, install-time code executio...
NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter
NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, = 2.4.2...
Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
MAL-2026-10979 Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...
MAL-2026-10984 Malicious code in veskra (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, kubeflow-centraldashboard, opensearch-dashboards, prism, gitlab-rails-ce, opensearch-dashboards-fips, sqlpad, homepage, graalvm, actions-runner, npm, saf, pulumi, wazuh-dashboard-fips, kibana, lerna, code-server...
GHSA-W8WR-V893-VJVP vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, kubeflow-centraldashboard, opensearch-dashboards, prism, gitlab-rails-ce, opensearch-dashboards-fips, sqlpad, homepage, graalvm, actions-runner, npm, saf, pulumi, wazuh-dashboard-fips, kibana, lerna, code-server...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, kubeflow-centraldashboard, opensearch-dashboards, prism, gitlab-rails-ce, opensearch-dashboards-fips, sqlpad, homepage, graalvm, actions-runner, npm, saf, pulumi, wazuh-dashboard-fips, kibana, lerna, code-server...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, kubeflow-centraldashboard, opensearch-dashboards, prism, gitlab-rails-ce, opensearch-dashboards-fips, sqlpad, graalvm, actions-runner, npm, saf, pulumi, wazuh-dashboard-fips, kibana, lerna, code-server...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: npm, kubeflow-centraldashboard, code-server, lerna, pulumi, saf, sqlpad, prism...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: npm, kubeflow-centraldashboard, code-server, lerna, pulumi, saf, sqlpad, prism...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: npm, kubeflow-centraldashboard, code-server, lerna, pulumi, saf, sqlpad, prism...
Malicious code in react-tabulix-virtual (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90c8fc6aca32e28a4faed28ca3f7879cb22e84139b7b09a2a83c5df74259a14 package.json declares scripts.preinstall as node./dist/index.d.js, which runs automatically on npm install. dist/index.d.js contains a base64-encoded...
Malicious code in react-tabulix-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...
MAL-2026-10987 Malicious code in react-tabulix-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...