CVE-2026-16735

The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...

EUVD-2025-176711

Malicious code in release-it-juno-cypress-ganymede npm...

EUVD-2025-177420

Malicious code in ora-release-it-ichnology-subscription npm...

Malicious code in release-it-library-start-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 348aaa3d96cbbca9efb6a3b8e5c7e01f9bfc1413dce9e60070864b028329ab09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176964

Malicious code in proxima-dotenv-safe-carpo-release-it npm...

EUVD-2025-176708

Malicious code in release-it-nova-orbit-figures npm...

EUVD-2025-176714

Malicious code in release-it-apollo-norma-vuepress npm...

EUVD-2025-176710

Malicious code in release-it-library-start-inquirer npm...

EUVD-2025-177121

Malicious code in plutology-release-it-despina-arcturus npm...

EUVD-2025-177753

Malicious code in morgan-sass-loader-release-it-quark npm...

EUVD-2025-175501

Malicious code in xenon-release-it-telesto-jabbah npm...

EUVD-2025-178340

Malicious code in iota-release-it-stream-xenos npm...

EUVD-2025-178555

Malicious code in helmet-release-it-enceladus-figures npm...

EUVD-2025-175938

Malicious code in titan-enceladus-release-it-callisto npm...

EUVD-2025-177833

Malicious code in mini-css-extract-plugin-paleoecology-redis-release-it npm...

Malicious code in release-it-biogeochemistry-geoarchaeology-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5743b02a4835cd12ed5f2fe483d4025048b9db674a57d31bcc2707937ddca19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179873

Malicious code in carpo-release-it-oberon-halley npm...

EUVD-2025-176713

Malicious code in release-it-biogeochemistry-geoarchaeology-protractor npm...

EUVD-2025-178836

Malicious code in framework-release-it-fornax-non-blocking npm...

EUVD-2025-176517

Malicious code in saturnology-astroinformatics-release-it-test npm...