196498 matches found
MAL-2026-16308 Malicious code in chat-adapter-matrix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5710eb2e1a2f6b7a4aca8d943953989e80e056cc77c2071027c2a78744b5ea3a [email protected] executes server.js from every npm lifecycle hook preinstall, install, postinstall, prepare, prepublish, preprepare,...
CVE-2026-45321-Tanstack
Supply Chain Attack Simulation — CVE-2026-45321 TanStack Educational Lab for Understanding npm Supply Chain Attacks, CI/CD Abuse, and Install-Time Code Execution Disclaimer This project is created only for: cybersecurity learning, defensive security research, local lab simulation, understanding t...
The vulnerability of the require.external component of the vm2 package manager NPM allows a attacker to execute arbitrary code.
The vulnerability of the require.external component in the vm2 package manager NPM is related to insufficient control over resources with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the crypto.setEngine() function in the vm2 package manager NPM allows a hacker to execute arbitrary code.
The vulnerability of the crypto.setEngine function in the vm2 package manager’s NPM library is related to improper management of processes. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to the disclosure of information in the erroneous data area, allows an intruder to gain unauthorized access to the protected information.
The vulnerability of the NPM packet manager’s library vm2 is related to the disclosure of information in the erroneous data area. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the NPM packet manager’s vm2 library, related to a flaw in the data protection mechanism, allows attackers to execute arbitrary code.
The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
The vulnerability of the Promise.prototype.finally() function in the vm2 package manager of NPM allows a attacker to execute arbitrary code.
The vulnerability of the Promise.prototype.finally function in the vm2 package manager of NPM is related to a data protection mechanism flaw. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...
The vulnerability of the command-line interface of the vm2 package manager NPM allows a hacker to execute arbitrary code.
The vulnerability of the command-line interface of the NPM package manager’s vm2 library is related to initialization errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code...
Vulnerability of the node component `sqlite` in the `vm2` package manager of NPM, allowing attackers to execute arbitrary code.
The vulnerability of the node:sqlite component in the vm2 library of the NPM package manager is related to a data protection mechanism breach. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...
The vulnerabilities of the `Buffer.from()` and `Buffer.concat()` functions in the `vm2` library from the NPM package manager allow a malicious actor to gain unauthorized access to protected information and cause service failures.
The vulnerabilities of the Buffer.from and Buffer.concat functions in the vm2 library from the NPM package manager are related to information disclosure. Exploiting these vulnerabilities could allow an attacker to gain unauthorized access to protected information and cause service failures...
The vulnerability of the `EventEmitter.prototype.emit` component in the `vm2` package manager of NPM allows a hacker to execute arbitrary code.
The vulnerability of the EventEmitter.prototype.emit method in the vm2 library of the NPM package manager is related to insufficient resource control with dynamic management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the NPM package manager vm2 library, related to the use of a name with an incorrect reference, allows attackers to execute arbitrary code.
The vulnerability of the NPM package manager’s vm2 library is related to the use of a name with an incorrect reference. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the tls.setDefaultCACertificates() function in the vm2 package manager NPM allows a attacker to execute arbitrary code.
The vulnerability of the tls.setDefaultCACertificates function in the vm2 package manager’s NPM library is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-52617
CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...
boha v0.20.2
@agntn/puzzles Public crypto puzzles and bounties, as typed records. You ask for a puzzle, you get its address, its key material and what happened on chain. Why? Every puzzle thread has the same three things: the addresses, the prizes, and who solved what. Every scanner and tracker re-types them...
Malicious code in @pwaplatform/module-sso-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...
MAL-2026-16299 Malicious code in @pwaplatform/module-sso-integration (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...
NPMAnalysis
Introduction Recently, security incidents related to NPM poisoning attacks have been emerging one after another. When such incidents occur, the affected NPM packages are often removed or unpublished from the NPM registry, making subsequent security analysis difficult. Based on this situation, a...
MAL-2026-16320 Malicious code in @siriusbeyond/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...
Malicious code in @siriusbeyond/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ed929a2d8cbd15860eaafb9eb773ad02f9b31f361514b47987eca8dfa1ae695 Package @siriusbeyond/[email protected] registers both preinstall and postinstall lifecycle scripts that execute callback.js on every npm install...