Malicious code in eslint-generate-prerelease (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26b3f1a7acd55a1642c9615fe72871781a6c0d6bea6f9d31aa42c700aa799704 Package ships an empty module index.js = 'module.exports = ;' under a name that resembles internal tooling, published at an inflated version 99.9.1 —...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +414 more potentially affected by CVE-2026-71848 via hono (>=4.12.0, <=4.12.33)

hono NPM version =4.12.0, =0.1.0-dev.2580522, =0.1.0, =0.3.1, =0.0.0-pr-306-20260707164534, =0.1.0, =0.5.5, =0.17.0, =0.6.0, =0.8.0, =0.5.3, =0.17.0, =0.1.4, =0.0.13, =0.1.5 and more Source cves: CVE-2026-71848 Source advisory: SNYK:JS-HONO-18593786...

0pflow (>=0.1.0-dev.2580522, <=0.1.0-dev.f5622ac), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +414 more potentially affected by CVE-2026-71848 via hono (>=4.12.0, <=4.12.33)

hono NPM version =4.12.0, =0.1.0-dev.2580522, =0.1.0, =0.3.1, =0.0.0-pr-306-20260707164534, =0.1.0, =0.5.5, =0.17.0, =0.6.0, =0.8.0, =0.5.3, =0.17.0, =0.1.4, =0.0.13, =0.1.5 and more Source cves: CVE-2026-71848 Source advisory: OSV:GHSA-54FX-42GC-7VW4...

@nx/powerpack-shared-fs-cache (>=5.0.0, <=5.0.7) potentially affected by CVE-2026-71476 via @nx/shared-fs-cache (>=5.0.0, <=5.0.7)

@nx/shared-fs-cache NPM version =5.0.0, =5.0.0, =5.0.7 Source cves: CVE-2026-71476 Source advisory: OSV:GHSA-VP3H-GHGH-JR7G...

@dargmuesli/nuxt-vio (>=18.3.17, <=22.0.0-beta.5) potentially affected by CVE-2026-71319 via @nuxt/devtools (>=3.0.0, <=3.2.4)

@nuxt/devtools NPM version =3.0.0, =18.3.17, =22.0.0-beta.5 Source cves: CVE-2026-71319 Source advisory: SNYK:JS-NUXTDEVTOOLS-18565128...

@dargmuesli/nuxt-vio (>=18.3.17, <=22.0.0-beta.5) potentially affected by CVE-2026-71319 via @nuxt/devtools (>=3.0.0, <=3.2.4)

@nuxt/devtools NPM version =3.0.0, =18.3.17, =22.0.0-beta.5 Source cves: CVE-2026-71319 Source advisory: OSV:GHSA-279X-MWFV-VCQV...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70603 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70603 Source advisory: SNYK:JS-ELECTRON-18563328...

@xwiki/cristal-electron-main (>=1.3.0, <=1.5.0), cicy-desktop (>=2.1.30, <=2.1.265) +2 more potentially affected by CVE-2026-70603 via electron (>=41.0.3, <=41.1.0)

electron NPM version =41.0.3, =1.3.0, =2.1.30, =0.1.0, =1.0.5, =1.3.0 Source cves: CVE-2026-70603 Source advisory: OSV:GHSA-5C9J-MHMV-5XGX...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70603 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-70603 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70603 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70603 Source advisory: OSV:GHSA-5C9J-MHMV-5XGX...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +128 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =7.0.0-canary.2, =7.5.9 and more Source cves: CVE-2026-69192 Source advisory: SNYK:JS-IPADDRESS-18516623...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +128 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =7.0.0-canary.2, =7.5.9 and more Source cves: CVE-2026-69192 Source advisory: OSV:GHSA-MWP4-54F8-5FHR...

@aikidosec/broker-client (>=1.0.47, <=1.0.49), @kirick/ip (0.2.1) +4 more potentially affected by CVE-2026-54272 via ip-address (>=10.1.1, <=10.2.0)

ip-address NPM version =10.1.1, =1.0.47, =0.6.0, =2.0.0, =0.1.3, =7.6.5-beta.0, =8.0.3 Source cves: CVE-2026-54272 Source advisory: OSV:GHSA-22JQ-VG5J-6VGG...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @donadiosolutions/lcm (1.4.2) +10 more potentially affected by CVE-2026-18446 via fast-uri (>=3.0.1, <=3.1.4)

fast-uri NPM version =3.0.1, =0.3.1, =1.2.0, =5.4.3, =0.1.0, =1.0.0, =1.0.0, =1.25.0, =0.1.5, =0.1.0, =2.2.0, =2.3.1 Source cves: CVE-2026-18446 Source advisory: OSV:GHSA-7P8R-X3MC-P8W7...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-18446 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-18446 Source advisory: OSV:GHSA-7P8R-X3MC-P8W7...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2647 more potentially affected by CVE-2026-69185 via socket.io-parser (>=4.0.1-rc1, <=4.2.6)

socket.io-parser NPM version =4.0.1-rc1, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2026-69185 Source advisory: OSV:GHSA-2M8V-J782-FHVR...

@ckeditor/ckeditor-cloud-services-collaboration (>=23.0.0, <=29.0.0), @ckeditor/ckeditor5-real-time-collaboration (>=29.1.0, <=33.0.0) +2 more potentially affected by CVE-2026-69185 via socket.io-parser (3.4.1)

socket.io-parser NPM version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on socket.io-parser and may be impacted: - @ckeditor/ckeditor-cloud-services-collaboration =23.0.0, =29.1.0, =29.0.0, =1.5.3, =2.1.0 Source cves: CVE-2026-69185 Source...

@abcpros/bitcore-build (>=8.25.29, <=8.25.30), @acanto/october-scripts (3.2.2) +1127 more potentially affected by CVE-2026-69185 via socket.io-parser (>=3.1.1, <=3.3.5)

socket.io-parser NPM version =3.1.1, =8.25.29, =1.0.0, =2018.7.11-0, =0.1.14, =1.0.2, =1.0.0, =1.2.0, =0.2.0-preview.3, =0.2.0, =1.0.10, =3.3.91, =3.3.114 and more Source cves: CVE-2026-69185 Source advisory: OSV:GHSA-2M8V-J782-FHVR...

0.edsql (>=1.0.49, <=1.0.50), 10secondsofcode-custom (1.0.0) +2647 more potentially affected by CVE-2026-69185 via socket.io-parser (>=4.0.1-rc1, <=4.2.6)

socket.io-parser NPM version =4.0.1-rc1, =1.0.49, =1.0.0, =0.0.28, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.0.1, =0.8.2, =1.0.0, =0.1.13, =0.0.4, =0.0.9 and more Source cves: CVE-2026-69185 Source advisory: SNYK:JS-SOCKETIOPARSER-18517008...