MAL-2026-239 Malicious code in chai-as-enhanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb34c187e4750d1e5a6dc3c297a953d8089f054d74e4cac7667532d81b72ea8 The package chai-as-enhanced was found to contain malicious code. Source: ghsa-malware cb4ee9056898577e40bbef5e13e321597457852aa84f71886d4aef75898669...

Malicious code in paytmsiddlewaree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1efaf28ec793c8856900b61d75973e6fb48c4c8d7081740ca4cb3fe5baa755f The package paytmsiddlewaree was found to contain malicious code. Source: ghsa-malware 0834762f3450b3984c00a9fa79f7b78cf3676dc0b91f86fd53b26649e9b991...

MAL-2026-238 Malicious code in paytmsiddlewaree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1efaf28ec793c8856900b61d75973e6fb48c4c8d7081740ca4cb3fe5baa755f The package paytmsiddlewaree was found to contain malicious code. Source: ghsa-malware 0834762f3450b3984c00a9fa79f7b78cf3676dc0b91f86fd53b26649e9b991...

CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...

CVE-2026-22771

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

CVE-2026-22771 Envoy Extension Policy lua scripts injection causes arbitrary command execution

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

MAL-2026-235 Malicious code in tailwindcss-animate-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 150bc7ffcbd255578f8dc6e8ce8781a01e97dcdc6a57436976f6b08beb371807 The package tailwindcss-animate-tool was found to contain malicious code. Source: ghsa-malware...

MAL-2026-218 Malicious code in express-sessions-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50976a5a79aa6e9a71eee66f3a74059d86a7620d670cf19ad43c9eb3619b0c2e The package express-sessions-id was found to contain malicious code. Source: ghsa-malware...

Malicious code in express-sessions-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50976a5a79aa6e9a71eee66f3a74059d86a7620d670cf19ad43c9eb3619b0c2e The package express-sessions-id was found to contain malicious code. Source: ghsa-malware...

Malicious code in cors-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 718e28ab42e6dd02cb599b331659e8f24be94c7d3b4e2dc859f1e09c34b7a822 The package cors-base was found to contain malicious code. Source: ghsa-malware 672c2f33d6521094e055da17d375ba21b3d35b58cd67db660f502e8f0512684d Any...

MAL-2026-216 Malicious code in cors-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 718e28ab42e6dd02cb599b331659e8f24be94c7d3b4e2dc859f1e09c34b7a822 The package cors-base was found to contain malicious code. Source: ghsa-malware 672c2f33d6521094e055da17d375ba21b3d35b58cd67db660f502e8f0512684d Any...

MAL-2026-230 Malicious code in passport-google-auth-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e78391289ff7e26ec937eb7519688992d2497e503ba4ca396d2c2a23b71235 The package passport-google-auth-token was found to contain malicious code. Source: ghsa-malware...

MAL-2026-213 Malicious code in @maxcointech/simple-string-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ce5c423557091383b99bcc8612d954b43dd380d8979019493ee390f7bfa5a30 The package @maxcointech/simple-string-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in simple-string-utils3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d9f9db863d718f528caa234dfa722b2631eb76195f504f47670898aeb0634a The package simple-string-utils3 was found to contain malicious code. Source: ghsa-malware...

Malicious code in @maxcointech/simple-string-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ce5c423557091383b99bcc8612d954b43dd380d8979019493ee390f7bfa5a30 The package @maxcointech/simple-string-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in passport-google-auth-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e78391289ff7e26ec937eb7519688992d2497e503ba4ca396d2c2a23b71235 The package passport-google-auth-token was found to contain malicious code. Source: ghsa-malware...

MAL-2026-226 Malicious code in jz-test-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dccb2f385b35a284dc2d3d339b412bc06502f9bc200809e770c9cdb5c27f4b8 The package jz-test-npm was found to contain malicious code. Source: ghsa-malware f20c59d3291432193fd98670d2b128aa82a1fb34d872f5c6d6fc37089e9d0fb7 An...

Malicious code in inquirer-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 477898ce4223aefeb43a52fa776b7236a069b176dff1c3a9cbfbb13ad57d6a59 The package inquirer-js was found to contain malicious code. Source: ghsa-malware 06897ddbb1fc8aa0c06fc7389198f7f96eceefdbbc08ead1032436eb45a0a0c3 An...

Malicious code in luxon-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6cf8bc36e6ae424cba2eb02275c950a8211e5342252662276b2c53afa5c8255 The package luxon-js was found to contain malicious code. Source: ghsa-malware 4fc26738db6a8729f71b32abddd5b6da3cce0b05e304b180ed3915f6cd07f746 Any...

Malicious code in react-hook-form-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10977fa5366d3d6e71079dade6da0fd8f346f3ce1d9d769f9664a89bdc7d4fe2 The package react-hook-form-js was found to contain malicious code. Source: ghsa-malware...