Malicious code in uac-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d2c2d224834611b638d571689ba89e7ad9b15f59f68a01f403056d02c9278c9 On npm install, [email protected] runs postinstall.js which calls integrate to silently modify the installer's own source tree without prompt or...

MAL-2026-10123 Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ab15ed01b9b4270e5605dcbb6ab8185f8b3501615c5f122a82d41deb14a7bff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10124 Malicious code in dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d49a62357bce8bee4379425fb0da49361a417e54e93334e5fd59a7b9601e61e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10122 Malicious code in dowload_ebok_murder_in_plain_english_by_michael_arntfield_marcel_danesi_uleto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c14d033e65a8eb68c616f92a5c9725e15522cfba83ec1a420d6438b2388871e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ROOT-APP-NPM-CVE-2022-0144 CVE-2022-0144 in @rootio/shelljs - Patched by Root

Root has patched CVE-2022-0144 in the @rootio/shelljs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44979 CVE-2026-44979 in @rootio/hapi__wreck - Patched by Root

Root has patched CVE-2026-44979 in the @rootio/hapiwreck package for Root:npm. Multiple fixed versions available...

MAL-2026-10103 Malicious code in optimize-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b77c2c0dab050d3a675407d74b649c73bfc107da05191cf041fb66e0346073a package.json declares optimize-regex as a dependency and devDependency of itself, resolved via a plain-HTTP tarball URL at...

MAL-2026-10099 Malicious code in polipoli-pak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8693677ff1f1f887c11d3b4f6ad3f1742c7eefd07b6b8cfabd6cfccc32bc48f On npm install, postinstall.js runs automatically and performs two unauthorized actions against the installer. First, it POSTs a JSON fingerprint of...

MAL-2026-10093 Malicious code in @andrewstory18/is-real-odd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a6faaf0fbf39ed9ec8797c97cb8b2486be8b84eb46bfeabc3412a3eeded4aa1 @andrewstory18/is-real-odd impersonates the widely-used is-odd package by copying its README, author, and repository metadata verbatim, but ships an...

MAL-2026-10078 Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

ROOT-APP-NPM-CVE-2026-44575 CVE-2026-44575 in @rootio/next - Patched by Root

Root has patched CVE-2026-44575 in the @rootio/next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-44906 CVE-2021-44906 in @rootio/minimist - Patched by Root

Root has patched CVE-2021-44906 in the @rootio/minimist package for Root:npm. Multiple fixed versions available...

ROS-20260709-73-0034

The vulnerability in python-pip relates to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Malicious code in @wagni_bot/ethereum-wallet (npm)

The npm package @wagnibot/ethereum-wallet is a supply-chain credential stealer disguised as a an Ethereum wallet library SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

Malicious code in @wagni_bot/pumpfun-sdk (npm)

The npm package @wagnibot/pumpfun-sdk is a supply-chain credential stealer disguised as a Pump.fun SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

CVE-2026-55849 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized `--workspace` Argument

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. From 2.1.0 before 5.0.0, the CLI passes user-supplied --workspace values to a subshell without proper sanitization when npmexecpath is unset or empty, allowing arbitrary OS command execution with the privileg...

MAL-2026-6991 Malicious code in airkey-mfa-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addd30fd6d90110d178ea017b2968c6014dab0e8304bdfeb55b13612a75f61da Package auto-executes a preinstall script node test.js on npm install that collects username, hostname, platform, Node version, and CI flag and POSTs...

MAL-2026-6987 Malicious code in @luminarycloudinternal/lcvis-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8dffb72c9f767cbd071bf482fce9acb1ff2283a4800b7862739348b7a89e24 Package @luminarycloudinternal/[email protected] is published to the public npm registry under an internal-looking scope with an artificially high...

MAL-2026-6985 Malicious code in promo-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a88c879a569b51180b134bd442917610efba2cfc54aa980cb3ec3b4731e84c No concrete evidence of installer-side harm was identified for this package version. There are no indicators of credential theft, environment scrapin...

Malicious code in dependency_confusions (npm)

The npm package dependencyconfusions version 99.9.9 performs install-time host fingerprint and project path exfiltration. package.json sets index.js as the package main entrypoint and defines postinstall: node index.js. During npm install, index.js builds a JSON payload containing the local...