EUVD-2026-62471

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-63643

creationtimestamp| type| source ---|---|--- 2026-08-18 18:35:06+00:00| published-proof-of-concept| https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-w6x9-28jw-hq7j...

Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

Malicious code in knip-bun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d412258df9a21f510333926a9be29bed8ae6368e549e295c84e187bdc1a3725 Package knip-bun typosquats the popular knip linter. The main module is an empty stub module.exports = , and package.json declares a dependency...

CVE-2026-73422

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:16+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6...

GHSA-7GMJ-H9XC-MCXC

creationtimestamp| type| source ---|---|--- 2026-08-11 09:43:37+00:00| seen| https://gist.github.com/hayageek/05ef86a8272d03ab9e54ab5476cf7afe...

MAL-2026-13772 Malicious code in camelot-ammv2-core (npm)

camelot-ammv2-core is a malicious npm package that impersonates Camelot DEX's AMM v2 core contracts. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the...

CVE-2026-48161

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48161

CVE-2026-48161 affects react18-use (a React 19 use hook shim). Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits that added src/install.js and wired it into postinstall, which fetched a JavaScript payload from an attacker-controlled HTTPS endpoint...

EUVD-2026-55848

react18-use is a React 19 use hook shim. Between 2026-05-19 01:07:01 and 2026-05-19 15:20:43, the default branch contained malicious commits 7b79148d1495a2505f9277da295a98cf176f4496 through 7b79148d1495a2505f9277da295a98cf176f4496 that executed remote attacker-controlled code on developer machine...

CVE-2026-48160

CVE-2026-48160 (react-tracked) describes malicious commits on the default branch that, during npm install, could execute attacker-controlled code on developer machines. The window between 2026-05-18 19:26:36 and 2026-05-19 15:22:45 included commits 6978272a7d6ca02225cb747ea69f427512e33699 through...

CVE-2026-48159

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

CVE-2026-48159

The issue affects the React-based project use-reducer-async. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits that wired a postinstall path to fetch and execute attacker-controlled JavaScript on developer machines during npm install. The payload ...

CVE-2026-48159

use-reducer-async is a React useReducer with async actions. Between 2026-05-18 16:29:52 and 2026-05-19 15:26:07, the default branch contained malicious commits da72edbde5705efcec6c62e0a3dcb73687b78dc8 through df07d5711458d8b46e11dd7afaaa21e88cafabfb that executed remote attacker-controlled code o...

CVE-2026-48158

use-context-selector is a React useContextSelector hook in userland Between 2026-05-18 15:57:18 and 2026-05-19 15:24:34, the default branch contained malicious commits 9d8481a513b7b0d1c0941b220c69b25de748641b through 6f2dae054ca014068bdbbb4db96006424d674124 that executed remote attacker-controlle...

PT-2026-69996

Name of the Vulnerable Software and Affected Versions react18-use affected versions not specified Description react18-use, a React 19 use hook shim, contained malicious commits in its default branch between 2026-05-19 01:07:01 and 2026-05-19 15:20:43. The issue involves the addition of...

PT-2026-69885

Name of the Vulnerable Software and Affected Versions use-reducer-async affected versions not specified Description Malicious commits were introduced into the default branch of the repository, which executed remote attacker-controlled code on developer workstations during the npm install process...

Malicious code in merchantweb-lang-cookie-reset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be package.json declares the sole dependency packet-table-thread-stream as a direct tarball URL to a non-npm host...

Malicious code in kepler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 672a1c042704318fe56d5da08c0f1d20b404274bd6ad339efc2f1c581d869d77 [email protected] declares its only runtime dependency, flag-serial-object-syntax, as an HTTP URL to a third-party host...

MAL-2026-13366 Malicious code in @workoscalif/sudoku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6502011179b6d16c43f982d5d7bfb08feec7470444be52a5a3547cfafe0e217 package.json declares a postinstall script that spawns vendor/gridgen-linux-x64 during npm install. The README describes this file as a 34 kB static...