205404 matches found
Malicious Package
Overview @yane88/idea-2026.2-01 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
Malicious code in matrix-by-lmx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7231cfc70a9c0bfad0c50204a6524688f4cdc2bb17c14de1db6554e42c177ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-15670 Malicious code in matrix-by-lmx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7231cfc70a9c0bfad0c50204a6524688f4cdc2bb17c14de1db6554e42c177ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in randomunblockedwebsite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b83fc58e6f99c840f46ca2ee474746a519a2047d1b3af82c3381e664205982f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15672 Malicious code in randomunblockedwebsite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b83fc58e6f99c840f46ca2ee474746a519a2047d1b3af82c3381e664205982f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15668 Malicious code in core_main (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e64170304c1f55aeeca3c096c224c5fe6301dafbd331bb943d08fc1a4bf0588f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15669 Malicious code in kendo-angular-window (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 012a21168890d2cc7482e8f4191dd4d1ee848314bdf7bc0970be32fb87a7ef25 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in core_main (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e64170304c1f55aeeca3c096c224c5fe6301dafbd331bb943d08fc1a4bf0588f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in kendo-angular-window (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 012a21168890d2cc7482e8f4191dd4d1ee848314bdf7bc0970be32fb87a7ef25 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in @fdr-mar/promos-types (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0ff10da2d93550bf81006c507400661d5d6d163e7ed31fd2dabc6c3d9be805e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-15671 Malicious code in quartz-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...
MAL-2026-15648 Malicious code in @fdr-mar/promos-types (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0ff10da2d93550bf81006c507400661d5d6d163e7ed31fd2dabc6c3d9be805e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in quartz-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...
PT-2026-89835
Root has patched GHSA-hcpx-6fm6-wx23 in the axios package for Root:npm. Multiple fixed versions available...
Malicious code in @mrlegendbot/baileys (npm)
@mrlegendbot/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that silently makes the victim account follow attacker-chosen WhatsApp newsletter channels. lib/Socket/newsletter.js adds a startAutoFeatures function line 230 that is scheduled with setTimeout =...
Malicious code in @systemzero/baileys (npm)
@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...
MAL-2026-15820 Malicious code in @systemzero/baileys (npm)
@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...
Malicious code in activerecord-databasevalidations (npm)
The package activerecord-databasevalidations was found to contain malicious code. --- Credit: OpenSSF source...
@pnpm/building.commands (>=1100.0.0, <=1100.1.7), @pnpm/deps.compliance.commands (>=1100.0.0, <=1101.5.0) +9 more potentially affected by CVE-2026-82392 via @pnpm/deps.graph-builder (>=1100.0.0, <=1100.0.18)
@pnpm/deps.graph-builder NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-82392 Source advisory: SNYK:JS-PNPMDEPSGRAPHBUILDER-19477021...
NPM: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input
NPM: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input vulnerability discovered by ? in WordPress Npm decode-uri-component versions = 0.4.2...