MAL-2026-11610 Malicious code in @onereach/or-content-builder-renderer (npm)

npm/@onereach/or-content-builder-renderer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...

MAL-2026-11554 Malicious code in @arv-bedrock/auth-admin (npm)

npm/@arv-bedrock/auth-admin is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11728 Malicious code in @or-sdk/source-api (npm)

npm/@or-sdk/source-api is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11631 Malicious code in @onereach/si-checkbox-group (npm)

npm/@onereach/si-checkbox-group is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @ornikar/jest-config-react-native-web (npm)

npm/@ornikar/jest-config-react-native-web is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojaniz...

Malicious code in @ornikar/babel-preset-kitt-universal (npm)

npm/@ornikar/babel-preset-kitt-universal is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanize...

Malicious code in @ornikar/eslint-config-typescript-nestjs (npm)

npm/@ornikar/eslint-config-typescript-nestjs is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...

MAL-2026-11818 Malicious code in @servicetitan/anvil-icons (npm)

npm/@servicetitan/anvil-icons is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11782 Malicious code in @picsart/gen-ai (npm)

npm/@picsart/gen-ai is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

MAL-2026-11630 Malicious code in @onereach/si-checkbox (npm)

npm/@onereach/si-checkbox is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @servicetitan/design-system (npm)

npm/@servicetitan/design-system is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11725 Malicious code in @or-sdk/settings (npm)

npm/@or-sdk/settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

MAL-2026-11641 Malicious code in @onereach/si-merge-tag-input (npm)

npm/@onereach/si-merge-tag-input is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11616 Malicious code in @onereach/orest-jest-presets (npm)

npm/@onereach/orest-jest-presets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/forge (npm)

npm/@servicetitan/forge is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11937 Malicious code in @servicetitan/titan-chat-ui-common (npm)

npm/@servicetitan/titan-chat-ui-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

MAL-2026-11928 Malicious code in @servicetitan/suppress-warnings (npm)

npm/@servicetitan/suppress-warnings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Linux Distros Unpatched Vulnerability : CVE-2026-13075

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregati...

CVE-2026-16870

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...

CVE-2026-16870

CVE-2026-16870 involves multiple security vulnerabilities in Snowflake libsnowflakeclient, affecting versions prior to 2.9.2. The issues include a stack-based buffer overflow in the file download path that could lead to remote code execution, and a related out-of-bounds write causing memory corru...