Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the POST /api/v1/repos/owner/repo/forks API endpoint, which fails to enforce the required organization repository creation permissions. An attacker can gain administrative control over a new repository within...

GHSA-FHX7-M96W-MV29 Gitea: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration

Summary The API endpoint POST /api/v1/repos/owner/repo/forks only checks IsOrgMember when a user forks a repository into an organization, but does not check CanCreateOrgRepo. The web UI fork handler correctly checks both. This allows a read-only organization member — in a team with...

CVE-2026-53870 Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

MAL-2026-6067 Malicious code in scan-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a7779ff21d9783e1026e13a7abf65e448c5f3d3d111f3cae539f3690e53a2b4 The CLI binary at bin/scan-only.js, when invoked e.g., via npx scan-only --diagnose, harvests installer-side secrets and ships them to a hardcoded...

Malicious code in @mastra/node-speaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1fc45cd66b93c4e1a83c1743f1ac9ee3ebea854208b1a9cae83ee957ebfd83 @mastra/node-speaker is a PCM audio output library wrapping native mpg123 bindings. Its package.json declares 'easy-day-js' ^1.11.21 as a runtime...

Malicious code in @mastra/node-audio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e67f59921eaf19b7b608ed824610779a1929306854008a2a1633edf67bca3b7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6045 Malicious code in @mastra/voice-elevenlabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f99d987467406ef04c81d4437451d8ba5f38649e85437a361470bb9fd94fbe53 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6023 Malicious code in @mastra/gcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 722de440c55cc50c4576818745c16ee5105f7cf4c61295943a07826b22be9387 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/voice-deepgram (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c6269a96366ca5cb804b7078f3eb2d0306ac86335922e3b00a17db6426024c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6038 Malicious code in @mastra/tavily (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3b560f62205cd42db16500f1d7d8d845fcfe70e261994de22e6d7d1a30b5a95 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6019 Malicious code in @mastra/docker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a207ac447f34657bb3cf28f05850031dc57ccb5a9b1082e792a7e420ef0fbc0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/turbopuffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73c50676f96c5af47167ce4405b1f53a38feb3cbd8a3eaf93fe262479680403 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6034 Malicious code in @mastra/qdrant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56b9276df2c5f66da957d7e30e4ed702cba5053f80e1a9f715b016b2e66a043 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6000 Malicious code in @mastra/auth-better-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f3ba577912ece34e70e0f5d94ee38bf681dc3f0d2a2125d0bbe95c98dbbe3a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ada3444d44067bbe5085e0892f7885b106c016c114676c2601b15bbb52ce4a4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5941 Malicious code in @mastra/braintrust (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dc69743b21fec5f3b447419f86b5799d5216e1f1f16d96c8aba930d99514553 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/fastify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ba29e7c4e2320b4f5852c18ded92c92021cfbc47d5bf8146b1a93ffa58260c7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8918dd16aca072972c93ebb866b08d6d5fda0b443955a2d4589ecbdbf4b87539 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5940 Malicious code in @mastra/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8918dd16aca072972c93ebb866b08d6d5fda0b443955a2d4589ecbdbf4b87539 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/dynamodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2567710170942391d967675952bbdd9cd0f8d933cc39e4cf4460ca4c5b700097 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...