CLEANSTART-2026-NS82585 Security fixes in renovate 44.31.0-r1

Package renovate version 44.31.0-r1 fixes 17 vulnerabilities: CVE-2026-39822, CVE-2026-56860, CVE-2026-56858, CVE-2026-33818, CVE-2026-46600...

ROOT-APP-NPM-CVE-2026-12590 CVE-2026-12590 in body-parser - Patched by Root

Root has patched CVE-2026-12590 in the body-parser package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48801 CVE-2026-48801 in linkify-it - Patched by Root

Root has patched CVE-2026-48801 in the linkify-it package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-29059 CVE-2021-29059 in is-svg - Patched by Root

Root has patched CVE-2021-29059 in the is-svg package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-28092 CVE-2021-28092 in is-svg - Patched by Root

Root has patched CVE-2021-28092 in the is-svg package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview bamru is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

ROOT-APP-NPM-CVE-2026-32621 CVE-2026-32621 in @apollo/federation-internals - Patched by Root

Root has patched CVE-2026-32621 in the @apollo/federation-internals package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-43414 CVE-2024-43414 in @apollo/gateway - Patched by Root

Root has patched CVE-2024-43414 in the @apollo/gateway package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-32031 CVE-2025-32031 in @apollo/gateway - Patched by Root

Root has patched CVE-2025-32031 in the @apollo/gateway package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-32030 CVE-2025-32030 in @apollo/gateway - Patched by Root

Root has patched CVE-2025-32030 in the @apollo/gateway package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-28154 CVE-2023-28154 in webpack - Patched by Root

Root has patched CVE-2023-28154 in the webpack package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-23061 CVE-2025-23061 in mongoose - Patched by Root

Root has patched CVE-2025-23061 in the mongoose package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2023-3696 CVE-2023-3696 in mongoose - Patched by Root

Root has patched CVE-2023-3696 in the mongoose package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-68429 CVE-2025-68429 in storybook - Patched by Root

Root has patched CVE-2025-68429 in the storybook package for Root:npm. Multiple fixed versions available...

Malicious code in @yane88/workbuddy-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dbb87f4a9b5e5482d4c8fdc2c448905f4a4df65feb64c3100385c616cf5470a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15664 Malicious code in @yane88/workbuddy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00baaa53d63c0bababb9db20aa5e86149da604834a5761b827edd2f936178c91 At npm install time, @yane88/[email protected]'s postinstall script pulls three sibling npm packages @yane88/workbuddy-01, -02, -03, each shipping a...

Malicious code in @yane88/listary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6260eed43832753ea0c07338c5b555cbe97792c6d22c086f83c7b97e60c6ff8c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/listary-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c557592d2b0b567ac07c3a66d9cc87f2bf6efb6b5646356c5d58afff3391f79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/workbuddy-03 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bc530be17afa04e087a63e6f15911946a729196caa40fe34096c11406f7cf1c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/hexhub-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a628c35399f2993b111f79396b198c542374b19367ccb6062c5f59f2b61dfdbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...