MAL-2026-10398 Malicious code in @db-tools/main-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d3b0edc39a389f4099895c647f0cdccbb08c85e56835670468e7a989b172e9f package.json declares a preinstall hook npm install @sentry/node && node examples/verify.js that fires on every npm install. examples/verify.js calls...

Malicious code in @db-tools/main-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d3b0edc39a389f4099895c647f0cdccbb08c85e56835670468e7a989b172e9f package.json declares a preinstall hook npm install @sentry/node && node examples/verify.js that fires on every npm install. examples/verify.js calls...

Malicious code in salesforce-vscode-slds (npm)

The salesforce-vscode-slds package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a...

MAL-2026-10234 Malicious code in slds-lsp-client (npm)

The slds-lsp-client package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Salesforce SLD...

MAL-2026-10228 Malicious code in chat-adapter-zoom (npm)

The chat-adapter-zoom package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Zoom...

Malicious code in slds-lsp-client (npm)

The slds-lsp-client package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Salesforce SLD...

Malicious code in chat-adapter-zoom (npm)

The chat-adapter-zoom package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Zoom...

MAL-2026-10232 Malicious code in salesforce-vscode-slds (npm)

The salesforce-vscode-slds package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a...

Malicious code in ec-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc8245936c8beb04bdb2bfe31a8117133823e3ffd6ed3e165d89b822dfab4a9c package.json declares a preinstall script that runs npm install @sentry/node && node examples/verify.js. examples/verify.js initializes the package's...

MAL-2026-6996 Malicious code in ec-checker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc8245936c8beb04bdb2bfe31a8117133823e3ffd6ed3e165d89b822dfab4a9c package.json declares a preinstall script that runs npm install @sentry/node && node examples/verify.js. examples/verify.js initializes the package's...

ROOT-APP-PYPI-CVE-2023-28117 CVE-2023-28117 in rootio-sentry-sdk - Patched by Root

Root has patched CVE-2023-28117 in the rootio-sentry-sdk package for Root:PyPI. Multiple fixed versions available...

aegea (>=2.0.0, <=2.2.5), chalice (>=1.14.1, <=1.16.0) +2 more potentially affected by CVE-2026-1703 via pip (20.1.1)

pip PYPI version 20.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aegea =2.0.0, =1.14.1, =0.1.0, =0.2.0 Source cves: CVE-2026-1703 Source advisory: OSV:PYSEC-2026-1796...

gerapy (>=0.9.5, <=0.9.6), scrapy-kk-plus (>=0.1.1, <=0.1.4) +5 more potentially affected by CVE-2025-6176 via scrapy (1.8.4)

scrapy PYPI version 1.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on scrapy and may be impacted: - gerapy =0.9.5, =0.1.1, =0.1.0, =0.1.0, =1.1.0, =0.1.10, =0.1.12 Source cves: CVE-2025-6176 Source advisory: OSV:PYSEC-2026-1906...

aegea (>=2.0.0, <=2.2.5), chalice (>=1.14.1, <=1.16.0) +2 more potentially affected by CVE-2025-8869 via pip (20.1.1)

pip PYPI version 20.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aegea =2.0.0, =1.14.1, =0.1.0, =0.2.0 Source cves: CVE-2025-8869 Source advisory: OSV:PYSEC-2026-1795...

dbaas-aclapi (>=0.1.17, <=1.0.14), py-kissmetrics (1.0.0) +1 more potentially affected by CVE-2025-50181 via urllib3 (1.7.1)

urllib3 PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on urllib3 and may be impacted: - dbaas-aclapi =0.1.17, =7.7.1, =7.7.4 Source cves: CVE-2025-50181 Source advisory: OSV:PYSEC-2026-1999...

Sentry improperly authorizes deletion of user issue alert notifications

ImpactAn authenticated user may delete user issue alert notifications for arbitrary users given a known alert ID. PatchesA patch was issued to ensure authorization checks are properly scoped on requests to delete user alert notifications.Sentry SaaS users do not need to take any action. Self-Host...

cbs-sentry-dingding (1.0.24), cbs-sentry-qyweixin (1.0.1) +47 more potentially affected by CVE-2024-41656 via sentry (20.8.0)

sentry PYPI version 20.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentry and may be impacted: - cbs-sentry-dingding 1.0.24 - cbs-sentry-qyweixin 1.0.1 - csnp =0.0.5, =1.0.0, =0.2.4, =1.0.0, =0.1.0, =0.4.0, =0.1.0, =0.2.0 and more Source cves:...

Sentry vulnerable to stored Cross-Site Scripting (XSS)

ImpactAn unsanitized payload sent by an Integration platform integration allows the storage of arbitrary HTML tags on the Sentry side. This payload could subsequently be rendered on the Issues page, creating a Stored Cross-Site Scripting XSS vulnerability. This vulnerability might lead to the...

aioshadowsocks (>=0.1.1, <=0.1.6), cellprofiler (>=4.0.7, <=4.2.8.1) +5 more potentially affected by CVE-2024-40647 via sentry-sdk (0.18.0)

sentry-sdk PYPI version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - aioshadowsocks =0.1.1, =4.0.7, =0.5.29, =0.13.0, =1.4.0, =0.2.9, =0.2.10 Source cves: CVE-2024-40647 Source advisory: OSV:PYSEC-2026-1917...

shioaji (>=0.0.6.dev6, <=0.0.6.dev8) potentially affected by CVE-2024-40647 via sentry-sdk (0.9.2)

sentry-sdk PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - shioaji =0.0.6.dev6, =0.0.6.dev8 Source cves: CVE-2024-40647 Source advisory: OSV:PYSEC-2026-1917...