MAL-2026-14405 Malicious code in create-json-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14406 Malicious code in dext-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329047f71cd6b35084bea7ed22978ba88e02cb557a5490b6133a70a5a0859a19 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14407 Malicious code in dext-crate-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e581bed6c9028ebf84b341f914135c1af62bc9b75072f1c511c4c187cb94abfd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in polis-diraja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71e55ed5112c3eba44560867e4b882d6c0135c379dd82eb8eb611f1aeb5f12b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14409 Malicious code in polis-diraja (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71e55ed5112c3eba44560867e4b882d6c0135c379dd82eb8eb611f1aeb5f12b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14404 Malicious code in @blurrydespair/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8 Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require o...

Malicious code in @blurrydespair/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8 Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require o...

Malicious code in react-emits (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91c19bc51fdcc52d657031b8a30c2fff700771d0948672a47033628784ec8acc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in agentgui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7712e51950473497493a076fd637f14d2ba2e5a0313e9e5556f73718b34aeba6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Scrapling v0.4.15

Effortless Web Scraping for the Modern Web العربيه | Español | Português Brasil | Français | Deutsch | 简体中文 | 日本語 | Русский | 한국어 Selection methods · Fetchers · Spiders · Proxy Rotation · CLI · MCP Scrapling is an adaptive Web Scraping framework that handles everything f...

Malicious code in svelte-dim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1857f7f4957bdb18eb0d5a997d957a38b825b62660f16d6a981232794cc10af0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14385 Malicious code in hydration-dim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3659ec02e8317602c089b822a4a0533bee515d9666d07fdaf3cdf8b315a46147 On import, dist/index.mjs verifies a SHA-256 digest of a bundled Linux x8664 ELF at dist/internal/calc.dat, chmods it to 0755, and spawns it detached...

Malicious code in @sdgdfgdfhhhfd/multiviewr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e2d548769641b2114a424739448d9df85d67cc176e694c6ff34ede446082b76 This package publishes a MetaMask snap that derives BIP44 entropy for coinType 60 Ethereum and transmits the resulting privateKey, publicKey and...

MAL-2026-14382 Malicious code in @sdgdfgdfhhhfd/chainvista (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf04f8e698eac423b3ba255617c60c9167b4b3453b7d73966ad62b02e0695a1 This MetaMask Snap derives BIP44 entropy for Ethereum coinType 60, Bitcoin 0, Solana 501, Cosmos 118, and Testnet 1 and POSTs the raw privateKey,...

Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14357 Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

MAL-2026-14354 Malicious code in kelly-sizing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ede654bccc4eb022f9faa5ceb79107da8ad0b1950db970b62de9771ec11428c4 [email protected] ships a postinstall script install-check.cjs that fetches a JSON config from...

MAL-2026-14352 Malicious code in tailwind-animate-css-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a4ac9c32887fff975dd06912302125d243af4f0bb2567714ef69ec763997e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102096)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102096 advisory. In the Linux kernel, the following vulnerability has been resolved: fbcon: Avoid OOB font access if console rotation fails Clear the font buffer if the reallocation...