195551 matches found
MAL-2026-14414 Malicious code in mcp-real-chrome (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 952bd642bd2f2aee3fd768385ee5d8dd3d5b387c7a9171e8ddcb8983f3499d2d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14413 Malicious code in livemcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80caa46e4bb231b0640c11ecb691ccf936f316205010487c57178eaf2100e8f7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in mcp-real-chrome (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 952bd642bd2f2aee3fd768385ee5d8dd3d5b387c7a9171e8ddcb8983f3499d2d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in dpg-media-7ehemel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594 npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment...
MAL-2026-14411 Malicious code in dpg-media-7ehemel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594 npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment...
MAL-2026-14410 Malicious code in @temptation.js/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ac41747a5c926627c28c9f1a651df91cd3447b07ca4cafabc1916004d1e70 The package registers a preinstall hook node index.js that runs on npm install and harvests installer-side data: os.hostname, OS username, home...
Malicious code in @temptation.js/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ac41747a5c926627c28c9f1a651df91cd3447b07ca4cafabc1916004d1e70 The package registers a preinstall hook node index.js that runs on npm install and harvests installer-side data: os.hostname, OS username, home...
CVE-2026-76845 adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction
adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...
MAL-2026-14407 Malicious code in dext-crate-image (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e581bed6c9028ebf84b341f914135c1af62bc9b75072f1c511c4c187cb94abfd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in dext-crate-check (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329047f71cd6b35084bea7ed22978ba88e02cb557a5490b6133a70a5a0859a19 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in dext-crate-image (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e581bed6c9028ebf84b341f914135c1af62bc9b75072f1c511c4c187cb94abfd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14408 Malicious code in dext-crate-video (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3becb032c5eb2c6055f81b9fc5dbd5d5c517d1c4028810110bd1b202ec4742e5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14405 Malicious code in create-json-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in dext-crate-video (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3becb032c5eb2c6055f81b9fc5dbd5d5c517d1c4028810110bd1b202ec4742e5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in create-json-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14406 Malicious code in dext-crate-check (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329047f71cd6b35084bea7ed22978ba88e02cb557a5490b6133a70a5a0859a19 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in @blurrydespair/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8 Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require o...
MAL-2026-14404 Malicious code in @blurrydespair/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8 Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require o...