GHSA-P498-V437-472G humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

@noema/mfs (>=0.1.0, <=0.3.0), @storm-software/config-tools (>=1.28.2, <=1.30.2) +1 more potentially affected by unknown CVE via @humanfs/node (>=0.11.0, <=0.16.7)

@humanfs/node NPM version =0.11.0, =0.1.0, =1.28.2, =3.0.0, =3.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-P498-V437-472G...

@noema/mfs (>=0.1.0, <=0.3.0), @storm-software/config-tools (>=1.28.2, <=1.30.2) +1 more potentially affected by unknown CVE via @humanfs/node (>=0.11.0, <=0.16.7)

@humanfs/node NPM version =0.11.0, =0.1.0, =1.28.2, =3.0.0, =3.2.1 Source cves: unknown CVE Source advisory: GHSA-P498-V437-472G...

Malicious code in argon-node (npm)

Source: amazon-inspector e3639b8833add6b5673b5f647479520157a22229369754ef98675e97a4a56385 The package argon-node was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in archaeometry-eventhoriz-taphonomy-node-sass (npm)

Source: amazon-inspector 60c3be56c95cdb3180faf1ff5f1f7ac9b1287134bb4a918d5d585bbae225d4bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in apachecn-node-zh-pt2 (npm)

The package apachecn-node-zh-pt2 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in antd-node-sass-zenobia-eris (npm)

Source: amazon-inspector a1a6abf162f2ff33e0e531ac0bacacc886441b2faaf429aec9919956afcd7939 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antd-node-config-slides-lyra (npm)

Source: amazon-inspector a989ab715d6a53eca8487e72199f2bab239e42894a2a0eeddcaa31fdaf4876c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antd-gatsby-node-sass-elektra (npm)

Source: amazon-inspector ed01c36eb6a4c2e8b3ef9636874282dd6992510cced87cdd70e89a6867b45717 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ambassador-node (npm)

The package ambassador-node was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in altair-prettier-node-config-prosthetics (npm)

The package altair-prettier-node-config-prosthetics was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in altair-mensa-cypress-node-sass (npm)

Source: amazon-inspector d753751860507a77cc68b0c83405e74048223a9aad75308e8a43711b12ff1817 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in alphard-gatsby-commitizen-node-config (npm)

Source: amazon-inspector aa5b5cad41900c2a1a91c718854a886f4827fa919f848f476fe11be4a3347afe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in alpha-helper (npm)

Source: amazon-inspector 9758eecca0cf755a3c7cc43115b413dfda31f149bbeed40cdfaeb5e46d739efb The exported getPlugin in index.js issues an HTTPS request to a hardcoded bare-IP endpoint at 46.183.25.232:45000/icons/116 and passes the response field data.credits into a new Function... constructor with...

Malicious Package

Overview arif-sate10-riris is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bt2-api-gateway-node-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

ROOT-APP-NPM-CVE-2026-27606 CVE-2026-27606 in rollup - Patched by Root

Root has patched CVE-2026-27606 in the rollup package for Root:npm. Multiple fixed versions available...

Malicious code in bt2-api-gateway-node-js (npm)

Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys, /.aws/credentials,config,sso/cache, /.azure, gcloud ADC,...

SUSE CVE-2026-83614

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...