1558 matches found
MAL-2026-11534 Malicious code in @zzzgenesis00/xrp-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ad59aa1c004d723d6e24f8113d8f3d45728c0b26fc41531ec00c0f91d2ddef The package impersonates XRPLF's xrp-lib author metadata and homepage point at github.com/XRPLF/xrp-lib while being published under an unrelated scop...
Shai-Hulud npm Worm Returns, Poisoning Over 1,280 npm Packages
Shai-Hulud npm worm spreads through Keyv and hundreds of packages with 2 billion monthly downloads, stealing npm, GitHub, cloud and CI credentials in real time...
MAL-2026-11706 Malicious code in @or-sdk/library (npm)
npm/@or-sdk/library is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...
GHSA-8JC8-CVQJ-P926 vulnerabilities
Vulnerabilities for packages: gitlab-workhorse-ce-fips, gitlab-cng, gitlab-runner, gitlab-workhorse-ce, gitlab-rails-ce, gitlab-cng-fips, gitlab-rails-ce-fips, gitlab-runner-fips...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...
Malicious Package
Overview 21st-angular is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-10901 Malicious code in solana-web3-lts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51efd3d5cdcb8fb794a1702f586abd7018d86aad3e40286f5a43dd1127d804ed Package name 'solana-web3-lts' resembles the widely-used '@solana/web3.js' Solana SDK, raising name-confusion concerns for installers reaching for th...
Malicious Package
Overview testzapier is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Fedora 43 : composer (2026-3017b1bec1)
The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3017b1bec1 advisory. Version 2.10.2 - 2026-07-01 Security: Validate package names GHSA-499r-g7pc-vmp9 Security: Validate package bin paths against path traversal...
RHSA-2026:37535 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Bulletin has no description...
GHSA-28X5-J68M-FXR3 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-2W8Q-JWXQ-9MRG vulnerabilities
Vulnerabilities for packages: chromium...
Malicious code in polymarket-kelly-stake-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9798cce0effcbcf5ed3295f322a375bb1a3cbb7e9db4b7d88c802bf5116639e3 [email protected] advertises itself as a pure Kelly-stake math helper but its postinstall hook scripts/install-check.cjs, invoked fro...
Malicious code in ts-eslint-jest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1ffed26d2d64bf9076210504de22b87e27a065821dedbc708fb05f7c47db74 The package [email protected] presents as a TypeScript/ESLint/Jest helper but ships lib/collect.js, which imports childprocess and invokes...
Malicious code in rzeactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7404 Malicious code in rngularjs (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in picnic-work-app-terms-of-use-de (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7332 Malicious code in options-msg (npm)
--- -= Per source details. Do not edit below this line.=-...