MAL-2026-13996 Malicious code in @nolimit-agent/linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a61df0713e6ffb3921a4819c4c80540bfd596d8b71e4f2015f3ed580c9f804d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @nolimit-agent/linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a61df0713e6ffb3921a4819c4c80540bfd596d8b71e4f2015f3ed580c9f804d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @nolimit-agent/win32-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4e440b5c1a499bb904b604509fd09284195641769bcea441044c9b15720106 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

CLEANSTART-2026-VJ19248 Security fixes in sqlpad 7.5.7-r3

Package sqlpad version 7.5.7-r3 fixes 26 vulnerabilities: ghsa-2v35-w6hq-6mfw, ghsa-f6ww-3ggp-fr8h, ghsa-wh4c-j3r5-mjhp, ghsa-x6wf-f3px-wcqx, ghsa-j759-j44w-7fr8...

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

CVE-2026-45819

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

browserslist: Browserslist: Prototype pollution leading to denial of service

A flaw was found in Browserslist, a tool for sharing browser and Node.js versions. An attacker could provide specially crafted statistics data, which the tool processes without proper validation. This improper handling of untrusted data can lead to prototype pollution, potentially causing the...

my-auto-follow (1.0.3) potentially affected by unknown CVE via @dreamguyxeon/libsignal-node (1.0.1)

@dreamguyxeon/libsignal-node NPM version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @dreamguyxeon/libsignal-node and may be impacted: - my-auto-follow 1.0.3 Source cves: unknown CVE Source advisory: SNYK:JS-DREAMGUYXEONLIBSIGNALNODE-18748591...

@dreamguyxeon/baileyx (>=1.0.0, <=5.0.0), @rishi56/baileys (1.0.0) +2 more potentially affected by unknown CVE via @dgxeon13/libsignal-node (1.0.0)

@dgxeon13/libsignal-node NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @dgxeon13/libsignal-node and may be impacted: - @dreamguyxeon/baileyx =1.0.0, =1.0.0, =1.0.2 - sayan-soket 1.0.0 Source cves: unknown CVE Source advisory:...

ROOT-APP-NPM-CVE-2017-16119 CVE-2017-16119 in fresh - Patched by Root

Root has patched CVE-2017-16119 in the fresh package for Root:npm. Multiple fixed versions available...

PT-2026-71422

baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service...

MAL-2026-14018 Malicious code in bs58-77 (npm)

npm/bs58-77 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-77x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-77x as a runtime dependency declar...

Malicious code in bs58-33 (npm)

npm/bs58-33 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-33x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-33x as a runtime dependency declar...

Malicious code in bs58-77 (npm)

npm/bs58-77 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-77x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-77x as a runtime dependency declar...

Malicious code in bs58-15 (npm)

npm/bs58-15 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-15x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-15x as a runtime dependency declar...

MAL-2026-14017 Malicious code in bs58-33 (npm)

npm/bs58-33 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-33x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-33x as a runtime dependency declar...

MAL-2026-13964 Malicious code in bs58-15 (npm)

npm/bs58-15 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-15x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-15x as a runtime dependency declar...

CVE-2026-73422

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:16+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6...

@rse/claudex (>=0.9.22, <=1.0.10), @snyk/snyk-cocoapods-plugin (>=2.6.0, <=3.1.1) +6 more potentially affected by CVE-2026-73411 via shescape (>=2.1.0, <=2.1.12)

shescape NPM version =2.1.0, =0.9.22, =2.6.0, =2.0.0, =8.0.0, =6.0.0, =3.0.0, =3.0.0, =3.1.2 Source cves: CVE-2026-73411 Source advisory: SNYK:JS-SHESCAPE-18752076...