Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

MAL-2026-10990 Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

MAL-2026-10670 Malicious code in eslintcmd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf4500fbbfc85f42275772210ace6efb69c5f90d9d0a5edd7c0c75fa271f0c3 The package's postinstall script scripts/install-check.cjs fetches a JSON config from https://slimopump.vercel.app/config/clob-math.json, downloads...

CVE-2026-50163

A flaw was found in oras-go, a Go library used for managing OCI Open Container Initiative artifacts. An attacker can exploit this vulnerability by providing a specially crafted tarball containing a malicious hardlink. When this tarball is extracted, the hardlink can be manipulated to point to fil...

MAL-2026-10581 Malicious code in process-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on...

MAL-2026-10553 Malicious code in home-mp-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single...

PYSEC-2026-2440 dbt-common's commonprefix() doesn't protect against path traversal

Impact What kind of vulnerability is it? Who is impacted? A path traversal vulnerability exists in dbt-common's safeextract function used when extracting tarball archives. The function uses os.path.commonprefix to validate that extracted files remain within the intended destination directory...

MAL-2026-10443 Malicious code in home-sections-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6c206f8844e1ff870876bc1ac8cdf2b10ee2c36caf61883eb5a8f03caa5405 package.json declares the dependency ltidisafe as a direct tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz hosted on an...

MAL-2026-10435 Malicious code in fetchcraft (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a40f1af8ba957a18b37ddba0dbe5634112f489841b22208eff421f9a09f786 package.json declares the runtime dependency node-runtime-utils as https://github.com/Hexa-devy/node-runtime-utils/archive/refs/heads/main.tar.gz — a...

MAL-2026-10415 Malicious code in frontend-regulations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d88817d57907505adf7d303019c78adceb6da7bedf1e3416f2b9a1e80605ca1 [email protected] is a near-empty wrapper index.js exports an empty object whose package.json declares the dependency 'ltidisafe' with the...

MAL-2026-10421 Malicious code in portway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e04dc52cd77658d168578535fb67d77ea76de79beadb77e14c96f023f4e51772 package.json declares the dependency 'ltidisafe' as a direct https tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.2.tgz...

MAL-2026-10422 Malicious code in sso-users-detection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc80441472ec24451f83aebdc186d5bc532ddadaac8888d3d30b72c17c94f993 [email protected] is a hollow package main exports , empty author/description, inflated 99.9.1 version whose sole effect on install is to pu...

Malicious code in terminal-mascot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fdf1ac60d0060cb78970c884bcfa7bb5360d9f700c0f8992b66af09cce22ae [email protected] ships a postinstall script install-check.cjs that resolves a bundle URL from a remote JSON config at...

MAL-2026-10424 Malicious code in terminal-mascot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fdf1ac60d0060cb78970c884bcfa7bb5360d9f700c0f8992b66af09cce22ae [email protected] ships a postinstall script install-check.cjs that resolves a bundle URL from a remote JSON config at...

Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

MAL-2026-10407 Malicious code in awesome-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...

MAL-2026-10391 Malicious code in tipsen-last (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8dda277dd82e1c50906cff18341bb76485eed33ba42d39b228c447514e4081f package.json declares its only runtime dependency "safe-chain-test" as a direct tarball URL on hoped-twice-evaluation-site.trycloudflare.com — an...

MAL-2026-10393 Malicious code in tipsen-poc-again (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0977477bc81c656f52fb981657983580b411dda6d2c6766ba4d6a35fe4ae970 package.json declares its sole runtime dependency safe-chain-test as an HTTPS tarball URL pointing at a trycloudflare.com quick-tunnel host...

MAL-2026-10198 Malicious code in polylabel-web-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce7df46acd8236fafbaa27dbccb92d1f286c17b023ea5ff555700e76c4a0188f [email protected] ships an empty index.js stub and declares its only runtime dependency as a direct tarball URL on a Google Cloud Storage...

Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...