GHSA-96QW-H329-V5RG Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

Summary Since 2017, the default webpack plugins have passed the entire process.env to EnvironmentPlugin. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code or any dependency referenced process.env.VARIABLENAME. This is not a regression...

EUVD-2026-1462

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles...

Shakapacker has environment variable leak via EnvironmentPlugin that exposes secrets to client-side bundles

Summary Since 2017, the default webpack plugins have passed the entire process.env to EnvironmentPlugin. This pattern exposed ALL build environment variables to client-side JavaScript bundles whenever application code or any dependency referenced process.env.VARIABLENAME. This is not a regression...

MAL-2026-159 Malicious code in chai-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c9efaf89a89b5eb291f14408bbc1259e6b222e9ee9445fc01c33753cdc7688 The package chai-min was found to contain malicious code. Source: ghsa-malware 986779b1404de4f7d2869e5db91f49bd49bc402934a8da2ff0990e656495b5a6 Any...

Malicious code in chai-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c9efaf89a89b5eb291f14408bbc1259e6b222e9ee9445fc01c33753cdc7688 The package chai-min was found to contain malicious code. Source: ghsa-malware 986779b1404de4f7d2869e5db91f49bd49bc402934a8da2ff0990e656495b5a6 Any...

Malicious code in jsonify-setting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8183b50e15a97c7409271a1f226a25472121ef2ff9abbd954ba9693ba63c6f6e The package jsonify-setting was found to contain malicious code. Source: ghsa-malware d31a9557fd6798ea1a21705b70127ad9840b9f527f34ed29161e68230fd1a86...

MAL-2026-160 Malicious code in json-mappings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e1cd8f06a356d4ca69b87f0f2e2dbd6245d42c08c515189c1681251d0cf3aa3 The package json-mappings was found to contain malicious code. Source: ghsa-malware f708e7c962688a26f87824a7ae962f667dc7238ba5b55aeb27c26e18c5f4b13f...

MAL-2026-161 Malicious code in jsonify-setting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8183b50e15a97c7409271a1f226a25472121ef2ff9abbd954ba9693ba63c6f6e The package jsonify-setting was found to contain malicious code. Source: ghsa-malware d31a9557fd6798ea1a21705b70127ad9840b9f527f34ed29161e68230fd1a86...

Malicious code in json-mappings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e1cd8f06a356d4ca69b87f0f2e2dbd6245d42c08c515189c1681251d0cf3aa3 The package json-mappings was found to contain malicious code. Source: ghsa-malware f708e7c962688a26f87824a7ae962f667dc7238ba5b55aeb27c26e18c5f4b13f...

Malicious code in shaktihacker2026 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cb6457a3349374a4197b81f898e8188fd1fa57b63d5d1585e4f06ddca09316 The package shaktihacker2026 was found to contain malicious code. Source: ghsa-malware 8576dcfc2ee1fd97abb2cb2200663eea4537f4a39053e01984a915f8b570d2...

MAL-2026-155 Malicious code in shaktihacker2026 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cb6457a3349374a4197b81f898e8188fd1fa57b63d5d1585e4f06ddca09316 The package shaktihacker2026 was found to contain malicious code. Source: ghsa-malware 8576dcfc2ee1fd97abb2cb2200663eea4537f4a39053e01984a915f8b570d2...

Malicious code in ncodeauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f00fcaac77b28bc2ce7fd09837de2d46fd48c6bd32d11d39a98e2450d754843f The package ncodeauth was found to contain malicious code. Source: ghsa-malware 844237bb9b9aab92cf332246dacc9675c295acc85e6f914b9b9da957f04f7490 Any...

MAL-2026-154 Malicious code in ncodeauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f00fcaac77b28bc2ce7fd09837de2d46fd48c6bd32d11d39a98e2450d754843f The package ncodeauth was found to contain malicious code. Source: ghsa-malware 844237bb9b9aab92cf332246dacc9675c295acc85e6f914b9b9da957f04f7490 Any...

Malicious code in test-thegenetic-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a1aa78e95a98adc8d2ce9a727c53e49e1a1cd5d91a052d5aadcb2ead7afe050 The package test-thegenetic-module was found to contain malicious code. Source: ghsa-malware...

MAL-2026-153 Malicious code in darknet-dispatches-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56bca60f1c0743747f152e1bb34d4c1242fc24bc3500bbc44d7dc2c5235e06e1 The package darknet-dispatches-internal was found to contain malicious code. Source: ghsa-malware...

Malicious code in darknet-dispatches-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56bca60f1c0743747f152e1bb34d4c1242fc24bc3500bbc44d7dc2c5235e06e1 The package darknet-dispatches-internal was found to contain malicious code. Source: ghsa-malware...

MAL-2026-157 Malicious code in test-thegenetic-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a1aa78e95a98adc8d2ce9a727c53e49e1a1cd5d91a052d5aadcb2ead7afe050 The package test-thegenetic-module was found to contain malicious code. Source: ghsa-malware...

Malicious code in sparkling-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49e0e650696ea120abbbc0a198865731fbeea781cc9ee947bd39c8f7d76c4eab The package sparkling-cli was found to contain malicious code. Source: ghsa-malware 6185870baa4e15b65e8df51e713dcb6e3e54d79fd00389cfa0f86421cef94f6e...

MAL-2026-156 Malicious code in sparkling-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49e0e650696ea120abbbc0a198865731fbeea781cc9ee947bd39c8f7d76c4eab The package sparkling-cli was found to contain malicious code. Source: ghsa-malware 6185870baa4e15b65e8df51e713dcb6e3e54d79fd00389cfa0f86421cef94f6e...

MAL-2026-158 Malicious code in timeout-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1df00c4c63fa8e52f67bf4d40b5dadae1ddcb640d127546671ce2bf53b5eafa7 The package timeout-ts was found to contain malicious code. Source: ghsa-malware 16cf2a5883796e1a03bb6cc6da0182692fa5962abe42950ba3d95709ca928a71 Any...