02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21433 more potentially affected by CVE-2026-84375 via js-yaml (>=3.0.0, <=3.15.1)

js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: CVE-2026-84375 Source advisory: SNYK:JS-JSYAML-19496768...

02.aula (1.0.0), 0xrtest (1.0.0) +10781 more potentially affected by CVE-2026-84375 via js-yaml (>=4.0.0, <=4.3.1)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.0.0-develop-20260120180031, =0.5.6 - @0xr404/0xrtest 1.0.0 and more Source cves: CVE-2026-84375 Source advisory: SNYK:JS-JSYAML-19496768...

Malicious code in chromatitle-dev (npm)

The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...

MAL-2026-15814 Malicious code in chromatitle-dev (npm)

The package 'chromatitle-dev' was identified as containing malicious obfuscated code. In src/utils/bootstrap.js, there is base64 encoded URL. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b720b488c4ac40cc60b8a514f2d16bf2858c4b501171816d38597aba076fe941...

@3ngram/server (>=1.2.6, <=1.8.2), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +965 more potentially affected by CVE-2026-84364 via hono (>=4.0.0, <=4.13.4)

hono NPM version =4.0.0, =1.2.6, =0.1.8-fix.3, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.148, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-84364 Source advisory: SNYK:JS-HONO-19499093...

@3ngram/server (>=1.2.6, <=1.8.2), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +965 more potentially affected by CVE-2026-84363 via hono (>=4.0.0, <=4.13.4)

hono NPM version =4.0.0, =1.2.6, =0.1.8-fix.3, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.148, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-84363 Source advisory: SNYK:JS-HONO-19499091...

HTTP Request Smuggling

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to HTTP Request Smuggling in its query parsing helpers, which do not terminate at the URL fragment and parse a ? appearing after a as the start of the query string. An attack...

@3ngram/server (>=1.2.6, <=1.8.2), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +965 more potentially affected by CVE-2026-39408 +1 more via hono (>=4.0.0, <=4.13.4)

hono NPM version =4.0.0, =1.2.6, =0.1.8-fix.3, =0.1.0, =0.3.1, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.148, =0.0.138, =0.0.0-pr-306-20260707164534, =0.9.0, =0.1.0, =0.1.5 and more Source cves: CVE-2026-39408, CVE-2026-84365 Source advisory: SNYK:JS-HONO-19499068...

@343dev/optimizt (>=12.0.0, <=13.0.0), @agilebot/vitepress-preset (>=0.8.9, <=0.9.6) +79 more potentially affected by CVE-2026-84370 via svgo (>=4.0.0, <=4.0.2)

svgo NPM version =4.0.0, =12.0.0, =0.8.9, =0.0.8, =0.0.1772240426360, =0.1.0, =1.0.0, =2.47.0, =0.16.2, =1.3.0-next.0, =3.0.0-next.0, =6.13.0, =0.0.1769658265953, =21.2.6, =1.6.9, =0.1.0-dev.00e4942, =0.3.0 and more Source cves: CVE-2026-84370 Source advisory: SNYK:JS-SVGO-19498539...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +246 more potentially affected by CVE-2026-84370 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84370 Source advisory: SNYK:JS-SVGO-19498539...

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-84370 via svgo (>=2.0.0, <=2.8.0)

svgo NPM version =2.0.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.14971.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...

@0xsequence/web3-onboard-plugin (2.0.5), @0xzoz/tallyho (>=2.0.11, <=2.0.14) +1796 more potentially affected by CVE-2026-84368 via joi (>=17.2.0, <=17.13.4)

joi NPM version =17.2.0, =2.0.11, =0.1.6-alpha.2, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =1.16.17-beta-0213b250, =1.8.31, =1.1.12, =1.7.1, =1.8.31, =1.0.0, =1.16.34-beta-20241113-102431-65542b84 and more Source cves: CVE-2026-84368 Source advisory: SNYK:JS-JOI-19498543...

@adatechnology/conversation-module (>=0.2.0, <=0.4.0), @adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35) +300 more potentially affected by CVE-2026-84368 via joi (>=18.0.0, <=18.2.3)

joi NPM version =18.0.0, =0.2.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =3.19.0 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-84368 Source advisory: SNYK:JS-JOI-19498543...

5ug-cli (>=1.0.72, <=1.4.0), @343dev/optimizt (6.0.0) +85 more potentially affected by CVE-2026-84369 via svgo (>=2.0.0, <=2.8.0)

svgo NPM version =2.0.0, =1.0.72, =1.1.2, =2.0.0-fix-trigger-remove-colors-config-e26731597751d1581014163b7e73df159cf80be3.1, =0.0.2-0, =4.55.0, =2.12.3-canary.621.14971.0, =2.1.0-beta-1, =2.1.0-beta-1, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =3.59.1--canary.1316.b3452bb.0, =4.0.0--canary.2146.fe4f461.0...

5ug-cli (>=1.0.68, <=1.4.0), @acronis-platform/figma-fetcher (>=0.1.3, <=0.4.2) +246 more potentially affected by CVE-2026-84369 via svgo (>=3.0.0, <=3.3.3)

svgo NPM version =3.0.0, =1.0.68, =0.1.3, =0.0.1, =0.1.0, =1.2.2, =0.1.20, =0.0.8-alpha.4, =0.0.8-alpha.229, =0.1.0, =11.0.1, =11.1.2 and more Source cves: CVE-2026-84369 Source advisory: SNYK:JS-SVGO-19498536...

@343dev/optimizt (>=12.0.0, <=13.0.0), @agilebot/vitepress-preset (>=0.8.9, <=0.9.6) +79 more potentially affected by CVE-2026-84369 via svgo (>=4.0.0, <=4.0.2)

svgo NPM version =4.0.0, =12.0.0, =0.8.9, =0.0.8, =0.0.1772240426360, =0.1.0, =1.0.0, =2.47.0, =0.16.2, =1.3.0-next.0, =3.0.0-next.0, =6.13.0, =0.0.1769658265953, =21.2.6, =1.6.9, =0.1.0-dev.00e4942, =0.3.0 and more Source cves: CVE-2026-84369 Source advisory: SNYK:JS-SVGO-19498536...

1-topshiriq (1.0.0), 3nit-utils (>=0.11.1, <=0.23.0) +4174 more potentially affected by CVE-2026-84367 via joi (>=14.3.1, <=17.13.4)

joi NPM version =14.3.1, =0.11.1, =0.0.1, =2.0.0, =0.1.2, =2.0.11, =0.1.6-alpha.2, =0.0.1, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.9 and more Source cves: CVE-2026-84367 Source advisory: SNYK:JS-JOI-19498547...

@adatechnology/conversation-module (>=0.2.0, <=0.4.0), @adobe/spacecat-shared-brand-client (>=1.1.31, <=1.1.35) +300 more potentially affected by CVE-2026-84367 via joi (>=18.0.0, <=18.2.3)

joi NPM version =18.0.0, =0.2.0, =1.1.31, =1.0.0, =1.8.6, =2.61.4, =1.4.60, =1.6.11, =1.19.1, =1.11.2, =2.2.1, =1.0.0, =1.12.0, =3.14.0, =3.19.0 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-84367 Source advisory: SNYK:JS-JOI-19498547...

@0xshogun/sdk (>=1.0.3, <=1.1.6), @100xsystems/test-suite-typescript (>=0.1.0, <=0.1.2) +1744 more potentially affected by CVE-2026-84373 via @vitest/mocker (>=2.1.0, <=4.1.10)

@vitest/mocker NPM version =2.1.0, =1.0.3, =0.1.0, =0.0.1, =0.2.4, =0.0.3, =0.2.0, =0.0.1, =0.1.1, =0.1.1, =1.0.0, =1.0.0, =0.1.0, =0.8.0, =0.0.14, =0.0.16 and more Source cves: CVE-2026-84373 Source advisory: SNYK:JS-VITESTMOCKER-19497933...

Malicious Package

Overview @viertechjs/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...