MAL-2026-11463 Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8634bdafa282ed99ee4b3edd205599207ac2f52a4d150d4bdd0f9b69326f64d lib/report.js in [email protected] collects installer-side data using node's os, childprocess, and fs modules os.hostname, os.userInfo,...

Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5603e10be681ac5a86236edb1ce9cf53615e02867d7ff230a392b8363d7220b The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/GitHub email via gh api, git...

Malicious code in iac-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90ccff89d665d28ad35ad8c285427a56af2c0d5862b432a7de604a99a0358d9 lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, executes local commands via execSync,...

08cms (1.0.0), 10secondsofcode-custom (1.0.0) +4544 more potentially affected by CVE-2026-53606 via sanitize-html (>=1.18.2, <=2.17.4)

sanitize-html NPM version =1.18.2, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =0.0.1, =0.6.0, =5.0.2, =0.0.1, =1.0.0, =0.1.0, =0.1.0, =11.1.0, =11.3.0 and more Source cves: CVE-2026-53606 Source advisory: OSV:GHSA-VCCV-CMXP-4J9H...

MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-65841 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-65841 Source advisory: SNYK:JS-JODIT-18507643...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-65841 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-65841 Source advisory: OSV:GHSA-45QG-252V-3F7P...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-58263 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-58263 Source advisory: OSV:GHSA-RXCW-MC6F-6HR3...

NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-54756 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-54756 Source advisory: OSV:GHSA-5957-5C94-3V7W...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-62324 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-62324 Source advisory: OSV:GHSA-J839-GQQ4-GF9J...

@myrtex-org/ui (>=1.0.1, <=1.2.10), @rosgrant-org/ui (>=1.0.1, <=1.0.4) +3 more potentially affected by CVE-2026-62324 via jodit (>=4.0.18, <=4.3.2)

jodit NPM version =4.0.18, =1.0.1, =1.0.1, =0.41.1, =2.0.0-alpha.2, =17.0.70, =17.2.9 Source cves: CVE-2026-62324 Source advisory: SNYK:JS-JODIT-18507647...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-18446 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-18446 Source advisory: SNYK:JS-FASTURI-18506908...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @donadiosolutions/lcm (1.4.2) +10 more potentially affected by CVE-2026-18446 via fast-uri (>=3.0.1, <=3.1.4)

fast-uri NPM version =3.0.1, =0.3.1, =1.2.0, =5.4.3, =0.1.0, =1.0.0, =1.0.0, =1.25.0, =0.1.5, =0.1.0, =2.2.0, =2.3.1 Source cves: CVE-2026-18446 Source advisory: SNYK:JS-FASTURI-18506908...

@dteam/safe-signer (0.1.0), @extrimian/kms-storage-vault (>=1.1.0, <=1.6.2) +15 more potentially affected by CVE-2026-55100 via hashi-vault-js (>=0.4.11, <=0.4.16)

hashi-vault-js NPM version =0.4.11, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1-beta.1, =3.1.13, =0.1.0, =1.0.0, =1.0.0, =0.0.1, =0.0.2 and more Source cves: CVE-2026-55100 Source advisory: OSV:GHSA-G956-2F74-RMV7...

@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +161 more potentially affected by CVE-2026-67550 via re2 (>=1.8.4, <=1.25.1)

re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =0.1.0, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =1.2.4 and more Source cves: CVE-2026-67550 Source advisory: OSV:GHSA-FF84-5F28-78QJ...

@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +161 more potentially affected by CVE-2026-68499 via re2 (>=1.8.4, <=1.25.1)

re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =0.1.0, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =1.2.4 and more Source cves: CVE-2026-68499 Source advisory: OSV:GHSA-6HXR-MR5R-9836...

@10xsai/cloudflare-router-nx-plugin (1.0.0), @abelfubu/schematics (0.1.1) +688 more potentially affected by CVE-2026-54753 via nx (>=17.0.4, <=22.7.1)

nx NPM version =17.0.4, =2.2.1, =0.0.1, =0.1.5, =0.0.3, =0.0.4, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =1.0.1 - @aloes/nx-heroku 0.4.1 - @altariotechnologieslisbon/query-resolver 0.14.2 and more Source cves: CVE-2026-54753 Source advisory: OSV:GHSA-G2R8-WVMJ-JF5W...

MAL-2026-11497 Malicious code in vite-tsconfig-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...

Malicious code in rollup-plugin-polyfill-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...