ROOT-APP-NPM-CVE-2026-33894 CVE-2026-33894 in node-forge - Patched by Root

Root has patched CVE-2026-33894 in the node-forge package for Root:npm. Multiple fixed versions available...

MAL-2026-14559 Malicious code in imo-allowlist-xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f429a987c3b4800204131b27faae0c29e55a0761a1fa2a0306ab14a343afd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in imo-allowlist-xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f429a987c3b4800204131b27faae0c29e55a0761a1fa2a0306ab14a343afd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

MAL-2026-14563 Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14553 Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bnotify-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0861227aa2c7246f74708656f530b7f99a71f6e6e0be93a1ea7dc3b2d6c814d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14551 Malicious code in bnotify-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0861227aa2c7246f74708656f530b7f99a71f6e6e0be93a1ea7dc3b2d6c814d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dumb-binding-gyp-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c522e725eb8c0c66cf1c713d966b16c91947d48c6fbe50af8782537f944b6da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14546 Malicious code in dumb-binding-gyp-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c522e725eb8c0c66cf1c713d966b16c91947d48c6fbe50af8782537f944b6da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in the_tax_free_cashier_is_at_9f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0596e225c3ec8b9dfbd5c47b4c4c02d5f5f15c1aff917e7ab480c21936184164 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in shai_hulululud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f613531d1e90bc815213b8b20e3f1d9c8889cb7429fe986306747a3b7da99f49 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in tset_racie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871 [email protected] ships a single 45KB obfuscator.io-style payload as its main entry index.js. The file consists of a 551-entry RC4-encrypted string...

MAL-2026-14550 Malicious code in tset_racie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73385958282f9bf88c54065467759596364447d221f34f4c349adb1a849c4871 [email protected] ships a single 45KB obfuscator.io-style payload as its main entry index.js. The file consists of a 551-entry RC4-encrypted string...

MAL-2026-14549 Malicious code in the_tax_free_cashier_is_at_9f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0596e225c3ec8b9dfbd5c47b4c4c02d5f5f15c1aff917e7ab480c21936184164 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in grandfather_of_the_desert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 225060668f93f07494e2698abf079d6214336445f644fe5f3b54e3e758b45927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14548 Malicious code in shai_hulululud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f613531d1e90bc815213b8b20e3f1d9c8889cb7429fe986306747a3b7da99f49 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14547 Malicious code in grandfather_of_the_desert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 225060668f93f07494e2698abf079d6214336445f644fe5f3b54e3e758b45927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14543 Malicious code in self-certificates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced9167241d391937ba7b1f2625aa3f8184d832ebc61c182936100ae3a3f13bd Package advertised as a self-signed TLS certificate generator ships a fake RSA private key at test/key.pem whose body, once the PEM headers are...