Malicious code in @skyeng/libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b92505d9c0107026c2298d6ec8da504657990b61e40754b62b2cb8e1bd5a0b The package @skyeng/libs was found to contain malicious code. Source: ghsa-malware b4801b107979e502d4889dc729885a390ebfc2db995cd1b2fd23d27e09613a1b A...

GHSA-69X3-G4R3-P962 Blocklist Bypass possible via ECDSA Signature Malleability

Impact When using P256 certificates which is not the default configuration, it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint. In order for this to affect a...

GHSA-VF6J-C56P-CQ58 MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token

Impact Disclosure of Salesforce OAuth bearer tokens used by the MCP. Patches fix applied in 0.1.10 Workarounds Rotate any Salesforce tokens/credentials used by MCP-Salesforce...

MAL-2026-801 Malicious code in @rsgweb/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee9f14ff2b440c9d947019c65ffaa29df41116c3e35f18691cfcce733246790a The package @rsgweb/utils was found to contain malicious code. Source: ghsa-malware a9a98e6a12ac6be8573661e76ab7342baf0c83aae4d1907c482230dd5606dbc9...

MAL-2026-797 Malicious code in @rsgweb/modules-core-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c68d1fafad6a94ebe843e20901dd8e5251d0b27b963d07e71ecefbd16c7465 The package @rsgweb/modules-core-feedback was found to contain malicious code. Source: ghsa-malware...

Malicious code in @meli-lint/eslint-config-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8f8e866ee1edded4e092e1ece0dac9fae771a6870cc053bcfe711d56d77b1e4 The package @meli-lint/eslint-config-base was found to contain malicious code. Source: ghsa-malware...

MAL-2026-794 Malicious code in @meli-lint/eslint-config-tests-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 132488198f2cf5f0c73a4f6dd4d766162d9ef2bae156055d07c84b60e3e7b26d The package @meli-lint/eslint-config-tests-jest was found to contain malicious code. Source: ghsa-malware...

PT-2026-6835

Name of the Vulnerable Software and Affected Versions Nebula versions 1.7.0 through 1.10.2 Description Nebula is a scalable overlay networking tool. When using P256 certificates which is not the default configuration, it is possible to evade a blocklist entry created against the fingerprint of a...

PT-2026-6868

Impact Disclosure of Salesforce OAuth bearer tokens used by the MCP. Patches fix applied in 0.1.10 Workarounds Rotate any Salesforce tokens/credentials used by MCP-Salesforce...

MAL-2026-768 Malicious code in debug-logger-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d31caf4d90f11bf1428172dce6844e28db1dff1aead31c396b1cc6b0e0462d7 The package debug-logger-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-757 Malicious code in internallib_v157 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d07f4a0d2270cdcb827bb50e9f546d7c4ab3b07ede66343b90478831a731b83 The package internallibv157 was found to contain malicious code. Source: ghsa-malware 2a4eddb6af3191b7183a9223407a3a1b9fb4e1b4e96da5ee15af1ae2f0515ac...

MAL-2026-755 Malicious code in @jes4l/react-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbda4aa24c8a13be0d237b206780fc2feb5778e65cebf430e2124e49a390cdde The package @jes4l/react-pkg was found to contain malicious code. Source: ghsa-malware 2bd5520cca8e57269ded7f69993dc5257f9085a6706d01d7bc60b17ec80534...

MAL-2026-746 Malicious code in react-count-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf23710693921f6b69d38cf0abd8fa7ce2f181bfa2df9fa9777f59e0e4954e7 The package react-count-sync was found to contain malicious code. Source: ghsa-malware 9a44b72820f2af0bcbd60f65787e0707617e4f7428aa2c9407bec9f8decb07...

Malicious code in react-count-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf23710693921f6b69d38cf0abd8fa7ce2f181bfa2df9fa9777f59e0e4954e7 The package react-count-sync was found to contain malicious code. Source: ghsa-malware 9a44b72820f2af0bcbd60f65787e0707617e4f7428aa2c9407bec9f8decb07...

Malicious code in dcf-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ecd9b19358b9d41493159b26a9674d97911b844be08acab24e938855a796ada The package dcf-commons was found to contain malicious code. Source: ghsa-malware 53fcdc9ba42b2a38388a8f7892b9ba26435e40dd2c5ad4247358620829f70b58 An...

MAL-2026-742 Malicious code in dcf-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ecd9b19358b9d41493159b26a9674d97911b844be08acab24e938855a796ada The package dcf-commons was found to contain malicious code. Source: ghsa-malware 53fcdc9ba42b2a38388a8f7892b9ba26435e40dd2c5ad4247358620829f70b58 An...

Malicious code in internationalized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bb89ff076b952ec364a4b84d4b37a0f83632bea82a2a63b9153d6af9a6145ad The package internationalized was found to contain malicious code. Source: ghsa-malware...

Malicious code in confluence-analytics-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ce55572584393fb9c1af657085c599ab0f699fd5bf4bfbcda2a47560c6a717c The package confluence-analytics-support was found to contain malicious code. Source: ghsa-malware...

Malicious code in docusaurus-plugin-launchdarkly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e875ce6b5b0d95c7100cdba68bed891c712b414716f07147e6a3f04f4f9b4789 The package docusaurus-plugin-launchdarkly was found to contain malicious code. Source: ghsa-malware...

MAL-2026-735 Malicious code in docusaurus-plugin-launchdarkly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e875ce6b5b0d95c7100cdba68bed891c712b414716f07147e6a3f04f4f9b4789 The package docusaurus-plugin-launchdarkly was found to contain malicious code. Source: ghsa-malware...