Malicious code in node-env-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...

CLSA-2026-1791467333 TuxCare security update for node-forge (3 CVEs)

TuxCare rebuilt node-forge to address 3 CVEs. Fixed in 1.3.3-tuxcare.2...

@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)

@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...

@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)

@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...

MAL-2026-17676 Malicious code in @bellaxchuu/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f70788aeca5b98fbe0c721d7f6a88c036d661c3f0132443a6bdb97080f5819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17672 Malicious code in @xayz/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a9744aa6c5f3c994e66b4847aba63d6cf1503583f0a23185c67bb32b7394e77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ROOT-APP-NPM-CVE-2026-22029 CVE-2026-22029 in @remix-run/router - Patched by Root

Root has patched CVE-2026-22029 in the @remix-run/router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-64718 CVE-2025-64718 in js-yaml - Patched by Root

Root has patched CVE-2025-64718 in the js-yaml package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44003 CVE-2026-44003 in vm2 - Patched by Root

Root has patched CVE-2026-44003 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44005 CVE-2026-44005 in vm2 - Patched by Root

Root has patched CVE-2026-44005 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-43998 CVE-2026-43998 in vm2 - Patched by Root

Root has patched CVE-2026-43998 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-24118 CVE-2026-24118 in vm2 - Patched by Root

Root has patched CVE-2026-24118 in the vm2 package for Root:npm. Multiple fixed versions available...

@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)

@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...

Malicious Package

Overview node-env-resolve is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-fetch-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @bellaxchuu/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview node-gyp-runtime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @xayz/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-106510

A flaw was found in plugin-techdocs-node. An authenticated attacker with permissions to register catalog entities can achieve arbitrary code execution by submitting a crafted documentation configuration file. When the documentation is built, the malicious markdown extensions setting triggers...

CVE-2026-106556

A flaw was found in the Backstage plugin-techdocs-node component. Insufficient validation of documentation configuration files during documentation generation allows sanitization checks to be bypassed. An authenticated user with permission to register or modify documentation sources can exploit...