Malicious code in ethers-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3959190c7c321e0d6f512b89b3c54a6399f3e6f7daecd0563ff753a6a6fed2f5 Package name typosquats the popular 'ethers' library. package.json declares a postinstall pointing at dist/index.min.js, whose sole top-level stateme...

MAL-2026-10580 Malicious code in ethers-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3959190c7c321e0d6f512b89b3c54a6399f3e6f7daecd0563ff753a6a6fed2f5 Package name typosquats the popular 'ethers' library. package.json declares a postinstall pointing at dist/index.min.js, whose sole top-level stateme...

ROOT-APP-NPM-GHSA-28HP-FGCR-2R4H GHSA-28hp-fgcr-2r4h in @rootio/angular - Patched by Root

Root has patched GHSA-28hp-fgcr-2r4h in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-5CP4-XMRW-59WF GHSA-5cp4-xmrw-59wf in @rootio/angular - Patched by Root

Root has patched GHSA-5cp4-xmrw-59wf in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-21490 CVE-2024-21490 in @rootio/angular - Patched by Root

Root has patched CVE-2024-21490 in the @rootio/angular package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-45296 CVE-2024-45296 in @rootio/path-to-regexp - Patched by Root

Root has patched CVE-2024-45296 in the @rootio/path-to-regexp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-4867 CVE-2026-4867 in @rootio/path-to-regexp - Patched by Root

Root has patched CVE-2026-4867 in the @rootio/path-to-regexp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-52798 CVE-2024-52798 in @rootio/path-to-regexp - Patched by Root

Root has patched CVE-2024-52798 in the @rootio/path-to-regexp package for Root:npm. Multiple fixed versions available...

MAL-2026-10578 Malicious code in @sqlite-group/sql-creator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d3bd76c01604d26251c1650c71f8a99ad32c5389c4e42795477ae660be33a2a The package is published under a scope that impersonates SQLite @sqlite-group and declares itself as "cloud definitions for node", but the shipped...

ROOT-APP-NPM-CVE-2025-64118 CVE-2025-64118 in @rootio/tar - Patched by Root

Root has patched CVE-2025-64118 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33891 CVE-2026-33891 in @rootio/node-forge - Patched by Root

Root has patched CVE-2026-33891 in the @rootio/node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-66031 CVE-2025-66031 in @rootio/node-forge - Patched by Root

Root has patched CVE-2025-66031 in the @rootio/node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33894 CVE-2026-33894 in @rootio/node-forge - Patched by Root

Root has patched CVE-2026-33894 in the @rootio/node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33895 CVE-2026-33895 in @rootio/node-forge - Patched by Root

Root has patched CVE-2026-33895 in the @rootio/node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33896 CVE-2026-33896 in @rootio/node-forge - Patched by Root

Root has patched CVE-2026-33896 in the @rootio/node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-24773 CVE-2022-24773 in @rootio/node-forge - Patched by Root

Root has patched CVE-2022-24773 in the @rootio/node-forge package for Root:npm. Multiple fixed versions available...

MAL-2026-10571 Malicious code in @wrenfield/viem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa26048a977a00adcd1ffc42ccf06110e3807bb2a3145a01fd01318dcfe79771 Package @wrenfield/viem impersonates the popular viem library homepage viem.sh, repo wevm/viem; README and authors fields credit the real viem...

Malicious code in akshajrawat.utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 105157af41712b64f8b36ec1cb01e28958e4ad828a0c08d0979a1f6e22d1f13d The package's package.json declares a postinstall lifecycle hook that runs automatically on npm install: node -e...

MAL-2026-10554 Malicious code in @akshajrawat/plugin-repo-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 596ef9a9a6888c00110ee80e3633052ed89887a8465e9a5eaa824a81e5211e46 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in micro-ui-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be44655a47177f3740201ddb9dc66db080b9f665354c78bcebeb9a2da3b11b7f On npm install, the package's postinstall script postinstall.js reads os.hostname and sends it as a query parameter in a plain-HTTP GET to a hardcode...