Malicious code in ai-pro-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...

Malicious code in notifications-broadcast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2 [email protected] ships an empty index.js module.exports = ; with placeholder metadata empty description, empty author, version 99.9.1...

Malicious code in cookie-parser-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c2bd7c1b5b363e72753401f6edebf816965a625227e6523210e4620ce9bb8a cookie-parser-js impersonates the widely used cookie-parser package: it copies TJ Holowaychuk / Doug Wilson author metadata, the description, the...

MAL-2026-10009 Malicious code in chain-api-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc73eb727778c3a543bdef1f6993d4c8be38da047fc97b7a0614bd195590249 chain-api-sdk presents itself as the upstream multichain-crypto-wallet library: README, badges, package.json repository.url, and homepage all point t...

CVE-2026-13149

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

Malicious code in thirdwb (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. thirdwb is a typosquat of the legitimate thirdweb package. It uses a side-loader technique, pulling in log-taker as a transitive dependency; the infostealer runs automatically via that dependency's...

coati-payroll (>=1.0.1 <=1.10.0), now-lms (>=1.0.3 <=1.2.3) +1 more potentially affected by CVE-2026-27641 via flask-reuploaded (>=1.2.0 <=1.4.0)

flask-reuploaded PYPI version =1.2.0, =1.0.1, =1.0.3, =4.6.1, =5.0.0 Source cves: CVE-2026-27641 Source advisory: OSV:PYSEC-2026-341...

ait-dsn (=2.0.0), ait-gui (>=2.4.0 <=2.4.1) potentially affected by CVE-2024-35058 via ait-core (>=2.3.5 <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35058 Source advisory: OSV:PYSEC-2026-261...

ait-dsn (=2.0.0), ait-gui (>=2.4.0 <=2.4.1) potentially affected by CVE-2024-35057 via ait-core (>=2.3.5 <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35057 Source advisory: OSV:PYSEC-2026-263...

ait-dsn (=2.0.0), ait-gui (>=2.4.0 <=2.4.1) potentially affected by CVE-2024-35059 via ait-core (>=2.3.5 <=2.5.2)

ait-core PYPI version =2.3.5, =2.4.0, =2.4.1 Source cves: CVE-2024-35059 Source advisory: OSV:PYSEC-2026-264...

a7a1234 (=1.0.0), aas2openapi (>=0.2.0 <=0.2.4) +2554 more potentially affected by CVE-2025-43859 via h11 (>=0.10.0 <=0.15.0)

h11 PYPI version =0.10.0, =0.2.0, =0.2.1, =1.2.1, =0.7.3.post0, =0.1.0, =2.0.0.1, =0.0.1, =0.1.0, =0.8.3, =0.1.0, =4.8.2, =0.1.0, =0.1.1 - adminui =1.5.2 and more Source cves: CVE-2025-43859 Source advisory: OSV:PYSEC-2026-348...

abdelrahman-obfuscate (>=1.0.0 <=1.0.1), abdo (=2.0.0) +181 more potentially affected by CVE-2026-48802 via python-engineio (>=3.10.0 <=4.13.1)

python-engineio PYPI version =3.10.0, =1.0.0, =2.0.0, =0.1.1, =0.1.1, =4.0.6, =0.16.0, =3.4.2, =0.9.0, =0.0.3, =4.0.2, =4.0.0.8, =0.0.1, =0.1.0b1 and more Source cves: CVE-2026-48802 Source advisory: OSV:GHSA-CGWC-PV48-FHJ5...

appyter (>=0.16.0 <=0.20.2), aprsd (>=3.4.2 <=3.4.4) +27 more potentially affected by CVE-2026-48802 via python-engineio (>=4.0.0 <=4.13.1)

python-engineio PYPI version =4.0.0, =0.16.0, =3.4.2, =0.50.1, =1.0.1, =0.4.4, =0.11.0, =0.0.1, =1.0.9, =6.0.44, =0.0.6, =0.2.2, =0.1.0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-48802 Source advisory: SNYK:PYTHON-PYTHONENGINEIO-17660884...

@10xsai/cloudflare-router-nx-plugin (=1.0.0), @abelfubu/schematics (=0.1.1) +629 more potentially affected by CVE-2026-54753 via nx (>=17.0.4 <=22.7.1)

nx NPM version =17.0.4, =0.1.5, =0.0.3, =0.0.47, =0.0.1, =17.0.2-alpha.2, =17.0.2-alpha.2, =8.1.1, =0.0.1, =0.0.1, =0.0.15 and more Source cves: CVE-2026-54753 Source advisory: SNYK:JS-NX-17660796...

CVE-2026-50016 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can...

org.webjars.npm:github-com-wavesoft-local-echo (=0.2.0), org.webjars.npm:launch-editor (=2.2.1) +2 more potentially affected by CVE-2026-13311 via org.webjars.npm:shell-quote (=1.8.3)

org.webjars.npm:shell-quote MAVEN version =1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:shell-quote and may be impacted: - org.webjars.npm:github-com-wavesoft-local-echo =0.2.0 - org.webjars.npm:launch-editor =2.2.1 -...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6910 more potentially affected by CVE-2026-54517 via tools.jackson.core:jackson-databind (>=3.0.0 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves:...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6910 more potentially affected by CVE-2026-54516 via tools.jackson.core:jackson-databind (>=3.0.0 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves:...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6931 more potentially affected by CVE-2026-54515 via tools.jackson.core:jackson-databind (>=3.0.0-rc1 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0-rc1, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves...

ai.abkr.open:any (>=1.0.6 <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +6931 more potentially affected by CVE-2026-54513 via tools.jackson.core:jackson-databind (>=3.0.0-rc1 <=3.1.3)

tools.jackson.core:jackson-databind MAVEN version =3.0.0-rc1, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.2, =0.1.0, =0.1.0, =0.3.0 and more Source cves...