613162 matches found
NPM: dssrf: any users using 1.1.1.1 DNS is impacted by SSRF
NPM: dssrf: any users using 1.1.1.1 DNS is impacted by SSRF vulnerability discovered by ? in WordPress Npm dssrf versions = 1.0.4...
SUSE CVE-2026-13346
pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...
@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +160 more potentially affected by CVE-2026-67550 via re2 (>=1.8.4, <=1.25.1)
re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =0.0.0-semantic-release, =0.0.1 and more Source cves: CVE-2026-67550 Source advisory: OSV:GHSA-FF84-5F28-78QJ...
NPM: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)
NPM: re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...
Regular Expression Denial of Service (ReDoS)
Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the FEATURES regex in nltk/corpus/reader/reviews.py. An attacker can hang...
@10xsai/cloudflare-router-nx-plugin (1.0.0), @abelfubu/schematics (0.1.1) +688 more potentially affected by CVE-2026-54753 via nx (>=17.0.4, <=22.7.1)
nx NPM version =17.0.4, =2.2.1, =0.0.1, =0.1.5, =0.0.3, =0.0.4, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =1.0.1 - @aloes/nx-heroku 0.4.1 - @altariotechnologieslisbon/query-resolver 0.14.2 and more Source cves: CVE-2026-54753 Source advisory: OSV:GHSA-G2R8-WVMJ-JF5W...
MAL-2026-11497 Malicious code in vite-tsconfig-svg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...
Malicious code in vite-tsconfig-svg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...
Malicious code in rollup-plugin-polyfill-hold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...
MAL-2026-11479 Malicious code in rollup-plugin-polyfill-hold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...
Malicious code in @0xlr/test-callback (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...
Malicious code in @0xlr/dep-confusion-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...
MAL-2026-11431 Malicious code in @0xlr/dep-confusion-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...
MAL-2026-11433 Malicious code in @0xlr/test-callback (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...
MAL-2026-11416 Malicious code in ailaunchkit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...
MAL-2026-11420 Malicious code in walmart-genai-trace (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 7e84b4bbb5660ea5c7f803c4e5d0b12dfe41c9bb147fd2228c72bdda2224291a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Malicious code in aiassistcore (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9561c11926b1e2d0a7f38f91edc062a77b27e624521dd7c1e500ef3c16a157a2 The package presents itself as 'AI assistant utilities' but its workspace.py implements two active attacks against the installer's Windows session. A...
Malicious code in aichannel (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...
MAL-2026-11415 Malicious code in aichannel (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...