Malicious code in randomunblockedwebsite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b83fc58e6f99c840f46ca2ee474746a519a2047d1b3af82c3381e664205982f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15672 Malicious code in randomunblockedwebsite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b83fc58e6f99c840f46ca2ee474746a519a2047d1b3af82c3381e664205982f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15669 Malicious code in kendo-angular-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 012a21168890d2cc7482e8f4191dd4d1ee848314bdf7bc0970be32fb87a7ef25 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in core_main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e64170304c1f55aeeca3c096c224c5fe6301dafbd331bb943d08fc1a4bf0588f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in kendo-angular-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 012a21168890d2cc7482e8f4191dd4d1ee848314bdf7bc0970be32fb87a7ef25 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @fdr-mar/promos-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0ff10da2d93550bf81006c507400661d5d6d163e7ed31fd2dabc6c3d9be805e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...

MAL-2026-15648 Malicious code in @fdr-mar/promos-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0ff10da2d93550bf81006c507400661d5d6d163e7ed31fd2dabc6c3d9be805e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15668 Malicious code in core_main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e64170304c1f55aeeca3c096c224c5fe6301dafbd331bb943d08fc1a4bf0588f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15671 Malicious code in quartz-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f59477bf2399742c785aa97d80d04b4800f66446ae3635167ba173d96080a91 On npm install, the package's preinstall hook package.json scripts.preinstall = node index.js executes index.js, which reads the installer's OS...

MAL-2026-15820 Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

Malicious code in @mrlegendbot/baileys (npm)

@mrlegendbot/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that silently makes the victim account follow attacker-chosen WhatsApp newsletter channels. lib/Socket/newsletter.js adds a startAutoFeatures function line 230 that is scheduled with setTimeout =...

Malicious code in @systemzero/baileys (npm)

@systemzero/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that adds a hidden remote-control channel. lib/Socket/index.js line 4 hardcodes SIGNALSTREAMURL = https://zone.api.br/api/owner/whatsapp-signal-stream, and makeWASocket, the library's socket-creation entrypoint, cal...

PT-2026-89835

Root has patched GHSA-hcpx-6fm6-wx23 in the axios package for Root:npm. Multiple fixed versions available...

Malicious code in activerecord-databasevalidations (npm)

The package activerecord-databasevalidations was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in accessible-apricot-mollusk (npm)

Source: amazon-inspector 0e981ab581b7132e2f6d3f06ed5538db2a5441f15339cd2da29adf40f67a3aab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in above_earthworm_z3n (npm)

Source: amazon-inspector 8f0fa0e888f548508de1bea6650b3dedac6f5c73641ae142dd920bc354b8f1ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

@pnpm/building.commands (>=1100.0.0, <=1100.1.7), @pnpm/deps.compliance.commands (>=1100.0.0, <=1101.5.0) +9 more potentially affected by CVE-2026-82392 via @pnpm/deps.graph-builder (>=1100.0.0, <=1100.0.18)

@pnpm/deps.graph-builder NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-82392 Source advisory: SNYK:JS-PNPMDEPSGRAPHBUILDER-19477021...

NPM: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input

NPM: decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input vulnerability discovered by ? in WordPress Npm decode-uri-component versions = 0.4.2...

@3kles/3kles-socketio (>=2.1.5, <=2.4.1), @5minds/processcube_engine (>=16.0.0-alpha.2, <=18.0.0-renovate-fc9b99-lz9hhvt1) +260 more potentially affected by CVE-2026-59724 via engine.io (>=6.5.1, <=6.6.6)

engine.io NPM version =6.5.1, =2.1.5, =16.0.0-alpha.2, =2.17.13, =1.16.10, =3.0.4, =2.0.28, =1.1.5-13, =0.1.0, =0.1.0, =0.1.0, =1.2.0, =12.0.1, =17.0.0 and more Source cves: CVE-2026-59724 Source advisory: OSV:GHSA-GR94-W7QR-F4J3...