Malicious code in prime-coding-agent (npm)

The npm package prime-coding-agent is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. It is a pure-JS proxy dist/index.js: it reads the developer's provider API keys e.g. process.env.EXAAPIKEY, NVIDIAAPIKEY, configured provider...

MAL-2026-16013 Malicious code in agent-free (npm)

The npm package agent-free is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes t...

Malicious code in @avigilon/node-webrtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...

MAL-2026-15865 Malicious code in @avigilon/node-webrtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...

MAL-2026-15909 Malicious code in 1nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43 Package name typosquats nestjs and declares postinstall: node index.js in package.json, so index.js runs automatically during npm install. index.js...

Malicious code in 1nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71ec2f3aadbe93023b18621b07d44da99f2d1a232a2905add322260456c9ef43 Package name typosquats nestjs and declares postinstall: node index.js in package.json, so index.js runs automatically during npm install. index.js...

MAL-2026-15908 Malicious code in 0nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...

Malicious code in 0nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54eee258f343282c30f3efc6b5effc8aac283b7b02421433c14dee3e14f27aa3 Package name 0nestjs targets developers mistyping nestjs. On npm install, the postinstall hook node index.js executes automatically and performs two...

@accounter/client (>=0.0.12-alpha-20260616111400-042980593a256ba48203b66c0e7e022e45b91fbd, <=0.1.0-alpha-20260806092250-bc394b1d7590fd72a701aba3bdd0e263201e18ab), @blinkk/root-cms (>=3.4.1, <=3.5.1) +36 more potentially affected by CVE-2026-85063 via csv-parse (>=7.0.0, <=7.0.1)

csv-parse NPM version =7.0.0, =0.0.12-alpha-20260616111400-042980593a256ba48203b66c0e7e022e45b91fbd, =3.4.1, =0.1.4, =0.1.0, =0.1.0, =0.1.0, =0.53.29, =20260617.1750.25, =20260617.1750.26, =0.15.2, =0.13.1, =0.13.1, =0.11.1, =0.11.3 and more Source cves: CVE-2026-85063 Source advisory:...

-fides-amor-et-lux (1.0.0), 1ib (>=1.0.9, <=1.0.11) +1168 more potentially affected by CVE-2026-33894 +1 more via node-forge (>=1.0.0, <=1.3.3)

node-forge NPM version =1.0.0, =1.0.9, =1.0.0, =7.10.2-para-beta.0, =1.3.0-patch.0, =0.0.1-custom-install-dir, =1.2.1, =1.0.0, =1.0.0, =1.2.6, =1.23.2, =1.35.0 - @arextest/arex-request-runtime 7.36.3 and more Source cves: CVE-2026-33894, CVE-2026-85393 Source advisory: OSV:GHSA-86W9-CPQP-85RV...

CVE-2026-77465

creationtimestamp| type| source ---|---|--- 2026-09-03 21:05:03+00:00| seen| https://gist.github.com/alon710/aeca88a9cadc2c33877b37b541208edc 2026-09-03 22:35:11+00:00| published-proof-of-concept| https://github.com/BinaryMuse/toml-node/security/advisories/GHSA-82x6-q7mm-w9cf 2026-09-03...

@fancyliu/speclite (>=0.1.0, <=0.4.1), actual-moneymoney (>=3.0.0, <=3.6.0) +1 more potentially affected by CVE-2026-77465 via toml (>=4.1.1, <=4.1.2)

toml NPM version =4.1.1, =0.1.0, =3.0.0, =2.7.0, =2.12.4 Source cves: CVE-2026-77465 Source advisory: SNYK:JS-TOML-19639695...

NPM: toml-node: Uncontrolled Recursion

NPM: toml-node: Uncontrolled Recursion vulnerability discovered by ? in WordPress Npm toml versions 4.2.0...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in lib/parser.js, where the mutually recursive peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process wi...

@fancyliu/speclite (>=0.1.0, <=0.4.1), actual-moneymoney (>=3.0.0, <=3.6.0) +1 more potentially affected by CVE-2026-77465 via toml (>=4.1.1, <=4.1.2)

toml NPM version =4.1.1, =0.1.0, =3.0.0, =2.7.0, =2.12.4 Source cves: CVE-2026-77465 Source advisory: OSV:GHSA-82X6-Q7MM-W9CF...

@fancyliu/speclite (>=0.1.0, <=0.4.1), actual-moneymoney (>=3.0.0, <=3.6.0) +1 more potentially affected by CVE-2026-63376 via toml (4.1.1)

toml NPM version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @fancyliu/speclite =0.1.0, =3.0.0, =2.7.0, =2.11.3 Source cves: CVE-2026-63376 Source advisory: SNYK:JS-TOML-19639693...

NPM: toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

NPM: toml-node: Prototype Pollution Leads to Object.prototype Corruption via proto Key-Path Desynchronization vulnerability discovered by ? in WordPress Npm toml versions 4.1.2...

@fancyliu/speclite (>=0.1.0, <=0.4.1), actual-moneymoney (>=3.0.0, <=3.6.0) +1 more potentially affected by CVE-2026-63376 via toml (4.1.1)

toml NPM version 4.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on toml and may be impacted: - @fancyliu/speclite =0.1.0, =3.0.0, =2.7.0, =2.11.3 Source cves: CVE-2026-63376 Source advisory: OSV:GHSA-V5MP-JGW5-2X6J...

GHSA-V5MP-JGW5-2X6J toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization

Summary toml.parse writes attacker-controlled keys onto Object.prototype. The compiler protects the tables it builds by creating them with Object.createnull, which neutralizes a direct proto table. An attacker bypasses that protection by routing a table path through a scalar value and into the re...

NPM: Phoenix: Presence keys colliding with `Object.prototype` members break existence checks

NPM: Phoenix: Presence keys colliding with Object.prototype members break existence checks vulnerability discovered by ? in WordPress Npm phoenix versions = 1.2.0-rc.0, 1.5.15...