EUVD-2026-2846

Malicious code in silvermine npm...

MiracleLinux 4 : rpm-4.8.0-19.0.1.AXS4 (AXSA:2012-45:01)

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2012-45:01 advisory. The RPM Package Manager RPM is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating...

EUVD-2026-2096

Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration...

@cenk1cenk2/renovate-config (>=2.3.95, <=2.3.148), @jamietanna/patch-testing (>=0.1.0, <=0.2.28) +7 more potentially affected by CVE-2026-76230 via renovate (>=35.159.7, <=40.21.2)

renovate NPM version =35.159.7, =2.3.95, =0.1.0, =0.7.0, =0.5.0, =0.1.0, =0.2.0, =0.0.1, =0.19.0 - @zotero-chinese/renovate-config 1.0.3 Source cves: CVE-2026-76230 Source advisory: OSV:GHSA-FR4J-65PV-GJJJ...

Renovate vulnerable to arbitrary command injection via npm manager and malicious Renovate configuration

Summary The user-provided string packageName in the npm manager is appended to the npm install command during lock maintenance without proper sanitization. Details Adversaries can provide a maliciously crafted Renovate configuration file to trick Renovate to execute arbitrary code. The...

EUVD-2026-2403

Malicious code in ts-tweetnacl npm...

EUVD-2026-2401

Malicious code in admin1001 npm...

EUVD-2026-2404

Malicious code in cnamts-captcha-component npm...

EUVD-2026-2405

Malicious code in helium-module npm...

EUVD-2026-2406

Malicious code in francium-web-visitors npm...

EUVD-2026-2407

Malicious code in francium-utils npm...

MAL-2026-242 Malicious code in francium-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bbfe7cfa0e201004579dc73a60307dbd93e6507801d3dd767b689cb748535c1 The package francium-utils was found to contain malicious code. Source: ghsa-malware 36e968a97c914ae6c1bf4fb980564d69546cc92105d1be341f56c933ec2caa12...

Malicious Package

Overview francium-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in extended-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1daed3089b5ef77daaeecaac9fe17f36363fd47d3dbe2814f5902c7ec3e61a74 The package extended-path was found to contain malicious code. Source: ghsa-malware 69c860714616f6ecc1c5b9d066780ece372fd1346ffce61438ecc12c9a98b30b...

EUVD-2026-2409

Malicious code in extended-path npm...

Malicious Package

Overview chai-as-enhanced is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-239 Malicious code in chai-as-enhanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb34c187e4750d1e5a6dc3c297a953d8089f054d74e4cac7667532d81b72ea8 The package chai-as-enhanced was found to contain malicious code. Source: ghsa-malware cb4ee9056898577e40bbef5e13e321597457852aa84f71886d4aef75898669...

EUVD-2026-2411

Malicious code in paytmsiddlewaree npm...

3m (>=0.1.0, <=0.1.3), aap-llamaindex (>=0.1.1.dev1, <=0.2.0) +354 more potentially affected by CVE-2024-58339 via llama-index (>=0.4.17, <=0.14.23)

llama-index PYPI version =0.4.17, =0.1.0, =0.1.1.dev1, =0.1.8, =0.0.2, =1.1.0a20250502, =0.10.0, =1.4.3, =0.1.0a0.dev0, =0.2.0a0, =0.1.0, =0.1.0a1, =1.0.1 and more Source cves: CVE-2024-58339 Source advisory: SNYK:PYTHON-LLAMAINDEX-14917160...

Malicious Package

Overview cors-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...