142655 matches found
ROOT-APP-NPM-CVE-2026-2391 CVE-2026-2391 in @rootio/qs - Patched by Root
Root has patched CVE-2026-2391 in the @rootio/qs package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-8723 CVE-2026-8723 in @rootio/qs - Patched by Root
Root has patched CVE-2026-8723 in the @rootio/qs package for Root:npm. Multiple fixed versions available...
MAL-2026-6386 Malicious code in evmdotjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2593392b2cb94ce2e63327e486ec5c1a2a738c76283c6b1958aa2b23a1cc7b0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in rollup-runtime-polyfill-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90dc8536f81ef2ffbd391877bbe1eefbefc900081ef6eaa9848548177c233167 Package name mimics the legitimate rollup-plugin-polyfill-node and copies its source the repository field in package.json points to...
MAL-2026-6372 Malicious code in rollup-runtime-polyfill-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90dc8536f81ef2ffbd391877bbe1eefbefc900081ef6eaa9848548177c233167 Package name mimics the legitimate rollup-plugin-polyfill-node and copies its source the repository field in package.json points to...
MAL-2026-6355 Malicious code in ppt-creator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8040bc58597dee52581beb232688c85302554af0af5726abc15c56a21ac69f2c On npm install, package.json's preinstall hook runs index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, dirname...
MAL-2026-6353 Malicious code in markdownlint-cli2-fix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca7d5154ecbbcc636198bd2314e1916e5f0673d37ab7b14caca2ea96ad5ac5e1 Package name 'markdownlint-cli2-fix' impersonates the popular 'markdownlint-cli2' linter but contains no linter functionality — the README states...
Malicious code in hunsterx-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32f2430d6e0da9484283d0012a16df0c593ccb5fa2a56ea727bd19ba435f964f preinstall.js executes a chain of evalBuffer.from'','base64'.toString payloads at npm install time. The decoded payloads collect host identity...
MAL-2026-6337 Malicious code in hunsterx-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32f2430d6e0da9484283d0012a16df0c593ccb5fa2a56ea727bd19ba435f964f preinstall.js executes a chain of evalBuffer.from'','base64'.toString payloads at npm install time. The decoded payloads collect host identity...
rpm: Command injection in rpmuncompress doUntar() via unescaped archive top-level directory name in popen() shell command
A command injection vulnerability was discovered in the rpmuncompress utility of RPM. When extracting certain archive formats ZIP, 7z, GEM to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command without properly sanitizing it. A specially...
MAL-2026-6329 Malicious code in @ravespaceio/browser-input (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4814ac9a416bc2053c14cc597f4587bca639c752bba54c8429c4be9b49f3137b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in parket-flow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e9b185a1b54e41a8fb900a67aab43dbb78abc4fea96e9ca05d356f6864e3bdd index.js imports childprocess and invokes execSync with bash and zsh shells index.js line 1, 301, 317. Without traced execution context it is not...
MAL-2026-6298 Malicious code in ttal2ttml (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29387ac35a2248ad2e4b287b8c082f8d1a8d03b4937fc84a5b81fb85697e19d4 package.json declares a preinstall lifecycle script that runs node -e "tryrequire'childprocess'.execSync'curl -sf...
Malicious code in new-ecro-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0826d146dbc513ac14f403eaa9ba65dffbd04da52c55ff1840ad153dab96e87 The package publishes verbatim big.js v7.0.1 source including the upstream copyright header, README, repository URL pointing to MikeMcl/big.js, and t...
Malicious code in poly-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5aab464aac47233efb564c52d5818fef783efa856f8318c61d61ef99ca0da4e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-6287 Malicious code in poly-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5aab464aac47233efb564c52d5818fef783efa856f8318c61d61ef99ca0da4e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: code-server, gemini-cli, saf, renovate, py3-captum, prism, kibana, actions-runner, node-gyp, pelias-api, haraka, npm, vitess...
GHSA-G8M3-5G58-FQ7M vulnerabilities
Vulnerabilities for packages: code-server, gemini-cli, saf, renovate, py3-captum, prism, kibana, actions-runner, node-gyp, pelias-api, haraka, npm, vitess...