ROOT-APP-NPM-CVE-2026-54289 CVE-2026-54289 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54289 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-39408 CVE-2026-39408 in hono - Patched by Root

Root has patched CVE-2026-39408 in the hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-39410 CVE-2026-39410 in hono - Patched by Root

Root has patched CVE-2026-39410 in the hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54290 CVE-2026-54290 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54290 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-26PP-8WGV-HJVM GHSA-26pp-8wgv-hjvm in hono - Patched by Root

Root has patched GHSA-26pp-8wgv-hjvm in the hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44457 CVE-2026-44457 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44457 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54286 CVE-2026-54286 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54286 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44456 CVE-2026-44456 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44456 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview @thone33/core-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in edu-npm-helper-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48359fa2dbbcd9c21e22de20140343078cd697b1bdfa5f3c59ce5ee77b4865b0 No suspicious code patterns, lifecycle hooks, network destinations, or credential-access behaviors were identified in this package version. Nothing i...

MAL-2026-11083 Malicious code in edu-npm-helper-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7f857929420503555e28dd3c702b2f60cbd705fd7be4a15009fc0536646978 No suspicious behaviors were identified in this package version. There is no evidence of install-time network activity, lifecycle scripts performing...

Malicious code in txs-runner-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaf4e668ad1a65cf7be8d260ba2c6ee46a31be7553bad3219775b61a5d226dfc Package [email protected] could not be fully characterized: automated tracing engaged with the package's files but its output was withheld by the...

Malicious code in txs-random-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9f40781ae94116a5e9e1fb190897b78899c9e66abd10f1eb63216b78e986953 Package [email protected] was inspected but no concrete a static rule matches or traced-code findings are available for this verdict. The behavior...

MAL-2026-11092 Malicious code in txs-sdk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 591592a5e386a92265d0197e095f692b23b00aabfd23f20bd4d29f156cd7c21a Package [email protected] could not be fully characterized: automated code tracing engaged with the package contents but the resulting output was...

MAL-2026-11081 Malicious code in amanexzyra-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c2dc37b7d123a5de5b204c909ddc35474421dc3e0e7a4f256691a54d825c20 Package name amanexzyra-baileys resembles the popular WhatsApp Web API library @whiskeysockets/baileys family, which has been a frequent target of...

MAL-2026-11073 Malicious code in @fazzcode/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f1bff90cd31ad87a8cd76716c0c7fb23b148c5fa1d4ac226ce3ea10ebf70835 @fazzcode/baileys is a fork of @whiskeysockets/baileys that re-exports the upstream makeWASocket API while injecting an undocumented remote-controlle...

@akunsansan0/pucuk5000 (1.1.6) potentially affected by unknown CVE via @akunsansan0/pucuk5000 (1.1.7)

@akunsansan0/pucuk5000 NPM version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on @akunsansan0/pucuk5000 and may be impacted: - @akunsansan0/pucuk5000 1.1.6 Source cves: unknown CVE Source advisory: SNYK:JS-AKUNSANSAN0PUCUK5000-18319552...

MAL-2026-11066 Malicious code in @ks-radar/radar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe5f14a06be3c24f9b771e8bbe33139614129069d276962f0c7e019fd89cbce On npm install, the package's preinstall lifecycle script preinstall.js reads a hex-encoded command string from preinstall.json, decodes it via...

Malicious code in swiper_angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...

MAL-2026-11070 Malicious code in whs4_deu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute filename path which...