pmg

Package Manager Guard PMG Schädliche npm- und pip-Pakete blockieren, bevor sie installiert werden. Verteidigung in der Tiefe für die Paketmanager, die Sie bereits verwenden. Warum PMG? Entwickler und KI-Codierungsagenten installieren täglich Pakete. Jedes npm install oder pip install führt Tausen...

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't...

tanstack-shield

🛡️ tanstack-shield Ein-Befehl-Scanner für Supply-Chain-Angriffe für CVE-2026-45321 / GHSA-g7cv-rxg3-hmpx Erkennt den „Mini Shai-Hulud“-Wurm, der am 11. Mai 2026 42 @tanstack/ npm-Pakete 84 bösartige Versionen kompromittierte. root@kitploit: One line — scan your project curl -fsSL...

tanstack-compromise-checker

tanstack-compromise-checker ⚠️ Aviso: Esta ferramenta foi criada para o meu próprio caso de uso. Todos os indicadores são derivados das seguintes fontes de advisories: GHSA-g7cv-rxg3-hmpx Snyk: TanStack npm packages compromised StepSecurity: Mini Shai-Hulud deep dive Se novos IOCs, variantes de...

np-audit

np-audit — npm-Paket-Auditor Statische Sicherheitsanalyse für npm-Pakete – erkennt obfuskierte Lifecycle-Skripte, bekannte Schwachstellen und bösartige Muster bevor sie ausgeführt werden. Direkter Ersatz für npm install und...

pkgxray

pkgxray — pre-install security for npm packages, MCP servers, and AI agents Inspect an npm package or MCP server before you install or connect to it, and get a deterministic, evidence-backed SAFE, REVIEW, or BLOCK verdict. Local, zero-dependency static analysis — normal scans never execute packag...

CVE-2026-73566 vulnerabilities

Vulnerabilities for packages: prism, pulumi, node-gyp, opensearch-dashboards, lerna, kubeflow-centraldashboard, code-server, npm, renovate, sqlpad...

scan-shai-hulud

scan-shai-hulud एक तेज़, शून्य-निर्भरता वाला Bash स्कैनर जो यह पता लगाता है कि आपकी मशीन CVE-2026-45321 "Mini Shai-Hulud" आपूर्ति श्रृंखला हमले से प्रभावित है या नहीं। 11 मई, 2026 को, TanStack, Mistral AI, UiPath, OpenSearch और Guardrails AI के 170 npm पैकेज और 2 PyPI पैकेज एक साथ जहर दिए गए।...

tanscript-exploit-check

Mini Shai-Hulud Supply Chain Attack — IOC Checker root@kitploit: curl -fsSL https://raw.githubusercontent.com/nkopylov/tanscript-exploit-check/main/check-tanstack-exploit.sh | bash Oder klonen und lokal ausführen: root@kitploit: git clone https://github.com/nkopylov/tanscript-exploit-check.git cd...

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence AI-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary,...

scavenger_scanner

CVE-2025-54313 IOC-Scanner Plattformübergreifende Scanner zur Erkennung von Indikatoren einer Kompromittierung IOCs im Zusammenhang mit dem Supply-Chain-Angriff auf eslint-config-prettier CVE-2025-54313. Am 18. Juli 2025 wurden mehrere beliebte npm-Pakete durch einen Phishing-Angriff...

@dreamguyxeon/baileyx (>=1.0.0, <=5.0.0), @rishi56/baileys (1.0.0) +2 more potentially affected by unknown CVE via @dgxeon13/libsignal-node (1.0.0)

@dgxeon13/libsignal-node NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @dgxeon13/libsignal-node and may be impacted: - @dreamguyxeon/baileyx =1.0.0, =1.0.0, =1.0.2 - sayan-soket 1.0.0 Source cves: unknown CVE Source advisory:...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1446 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =1.0.0, =0.2.0, =0.0.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.104.0, =0.1.0, =0.2.340, =0.1.0, =0.17.9, =0.22.4 and more Source cves: CVE-2026-16633 Source advisory: OSV:GHSA-HQ66-CQWQ-W95J...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.27), @142vip/vuepress (0.0.1-alpha.19) +211 more potentially affected by CVE-2026-71438 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.15.0, =0.35.0, =0.2.0, =1.0.1 and more Source cves: CVE-2026-71438 Source advisory: OSV:GHSA-C4C3-PG64-4M4V...

@appweaver/core (>=1.1.6, <=1.4.0), @cappa/cli (0.11.1) +15 more potentially affected by CVE-2026-18427 via @fastify/static (>=10.1.0, <=10.1.2)

@fastify/static NPM version =10.1.0, =1.1.6, =3.1.17, =0.4.0, =0.1.0-rc.2, =5.27.1-beta.7, =9.0.0-canary.19, =0.2.1, =0.3.5 - pi-workspace 0.6.2 and more Source cves: CVE-2026-18427 Source advisory: SNYK:JS-FASTIFYSTATIC-18592349...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +79 more potentially affected by CVE-2026-71321 via nuxt (>=3.1.2, <=3.21.8)

nuxt NPM version =3.1.2, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-71321 Source advisory: OSV:GHSA-9PGF-384G-P7MV...

@bloggrify/bento (>=3.0.0, <=3.1.0), @bloggrify/core (>=3.0.0, <=3.3.0) +22 more potentially affected by CVE-2026-71321 via nuxt (>=4.0.0-rc.0, <=4.5.0)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =1.6.0-rc.3, =0.4.5, =0.0.0, =1.1.0, =2.0.1 - @uxfront/layer-app 0.1.0 - @zach-mac/zachscommoncomponents 1.0.4 and more Source cves: CVE-2026-71321 Source advisory: OSV:GHSA-9PGF-384G-P7MV...

@bloggrify/bento (>=3.0.0, <=3.1.0), @bloggrify/core (>=3.0.0, <=3.3.0) +22 more potentially affected by CVE-2026-71318 via nuxt (>=4.0.0-rc.0, <=4.5.0)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =1.6.0-rc.3, =0.4.5, =0.0.0, =1.1.0, =2.0.1 - @uxfront/layer-app 0.1.0 - @zach-mac/zachscommoncomponents 1.0.4 and more Source cves: CVE-2026-71318 Source advisory: SNYK:JS-NUXT-18565118...

@bloggrify/bento (3.1.0), @bloggrify/core (>=3.2.0, <=3.3.0) +11 more potentially affected by CVE-2026-71315 via nuxt (>=4.4.7, <=4.5.0)

nuxt NPM version =4.4.7, =3.2.0, =1.13.12, =1.6.0-rc.3, =1.0.0-alpha.17, =1.0.0, =0.6.0-rc.4, =0.2.3, =1.0.0-alpha.12, =1.0.0-alpha.20 Source cves: CVE-2026-71315 Source advisory: OSV:GHSA-HXVH-4H3W-PRP9...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70612 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....