GHSA-97WV-P4XX-C7MG ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

Summary The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the...

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

Summary The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the...

Malicious code in hardhat-deep (npm)

Source: amazon-inspector fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304 The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree README, SECURITY.md, index.d.ts, lib/proto.js, lib/transport.js, lib/worker.js, lib/levels.js,...

Malicious code in hardhat-deep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304 The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree README, SECURITY.md, index.d.ts, lib/proto.j...

CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

CVE-2026-102984 Astro: Malformed port in the Host header can crash the Node adapter

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

CVE-2026-102984

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

PT-2026-103281

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

CVE-2026-82936 Denial of Service in mH-DEVELOPER

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in...

Malicious code in godzz (npm)

Source: amazon-inspector 3b5d71d42ffa8a11d58cf5bf2cf8eab5f95e14d047f0907b6e0581a3c33ea299 On module load, godzz sets process.env.NODETLSREJECTUNAUTHORIZED='0', disabling TLS certificate validation for the entire Node process. Its main entry attaches to a local Chromium CDP endpoint at...

Malicious code in @asenfotech/unplugin-element-plus (npm)

Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under lib/gradle/ implements an install-time and import-time...

MSC-2026-11635

Trojanized mathjs clone. lusolve calls removeSolveValidation, which calls is.isGraph: it AES-256-GCM-decrypts a filename and a module from bundled ciphertext utils/graph.js, utils/fraction.js, utils/bignumber/type.js, writes the plaintext to disk and requires it, executing attacker-supplied code ...

MSC-2026-11634

Trojanized mathjs clone. lusolve calls removeSolveValidation, which calls is.isGraph: it AES-256-GCM-decrypts a filename and a module from bundled ciphertext utils/graph.js, utils/fraction.js, utils/bignumber/type.js, writes the plaintext to disk and requires it, executing attacker-supplied code ...

Malicious code in chai-as-agile (npm)

Source: amazon-inspector 90d46bc75e0c086e929855baefd9f9f847ebe6e85f8a004c9de72502d0fb6263 On require'chai-as-agile', index.js loads lib/initializeCaller.js which decodes a base64-obfuscated URL to https://ipcheck-hashed.vercel.app/api/auth/6c1d60d35852ef0c05df and POSTs the full contents of...

Malicious code in pinochiomathm (npm)

Source: amazon-inspector 135c673bb3925502b10f92d9819d956004ade25faa9c358f6d3fb2c67cd6114e The package impersonates picomatch name 'pinochiomathm', description copied from picomatch, homepage pointing at github.com/micromatch/picomach. On require, lib/pinochiomathm.js reads lib/parse.ts.map,...

Malicious code in tailwind-aspect-styles (npm)

Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in the consumer's working directory, and immediately requires t...

Malicious code in tailwindcss-3d-styles (npm)

Source: amazon-inspector 6afb2de10208993a1e7511cb81a6f11806561b389673da3fa24d22598178b744 The package's main entry point fetches a JavaScript file from http://23.27.245.100:3000/index.js over plain HTTP at require time, writes the response to./inout.js in the current working directory, and requir...

Malicious code in taskforge-9xv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b03d2c3ed0eec654a85d7843b208bdca926027df8dac14aa881f50c21a08f40 The taskforge CLI, once configured with an origin URL via taskforge setup --origin-server , fetches bytes from /api/x-handler and pipes them into a...

Malicious code in tailwindcss-forms-style (npm)

Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after module.exports. The decoded payload queries public Ethereum RPC...