MAL-2026-5886 Malicious code in @vantuz/sdk-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c955778a77086457edcccd20b8727c9f99b39c554fabea07dfb32f784d0f040 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@agentholdings/agent-passport (>=0.1.0 <=0.1.5), @chrysb/alphaclaw (>=0.8.3 <=0.9.0-beta.7) +14 more potentially affected by unknown CVE via openclaw (>=0.0.1 <=2026.4.1)

openclaw NPM version =0.0.1, =0.1.0, =0.8.3, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 - tokaroo-openclaw-provider =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-525J-HQQ2-66R4...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-6011 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-6011 Source advisory: OSV:GHSA-52VJ-FVRV-7Q82...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-41387 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-41387 Source advisory: OSV:GHSA-J7P2-QCWM-94V4...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35632 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35632 Source advisory: OSV:GHSA-7XR2-Q9VF-X4R5...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35658 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35658 Source advisory: OSV:GHSA-CFP9-W5V9-3Q4H...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35655 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35655 Source advisory: OSV:GHSA-74WF-H43J-VVMJ...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35635 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35635 Source advisory: OSV:GHSA-RQP8-Q22P-5J9Q...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35662 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35662 Source advisory: OSV:GHSA-X2CM-HG9C-MF5W...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35656 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35656 Source advisory: OSV:GHSA-844J-XRRQ-WGH4...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35639 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35639 Source advisory: OSV:GHSA-HF68-49FM-59CQ...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35622 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35622 Source advisory: OSV:GHSA-MP66-RF4F-MHH8...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35624 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35624 Source advisory: OSV:GHSA-XHQ5-45PM-2GJR...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35649 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35649 Source advisory: OSV:GHSA-PW7H-9G6P-C378...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35637 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35637 Source advisory: OSV:GHSA-VFG3-PQPQ-93M4...

vantuz (>=3.3.2 <=3.3.7) potentially affected by unknown CVE via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: unknown CVE Source advisory: OSV:GHSA-3W6X-GV34-MQPF...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35652 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35652 Source advisory: OSV:GHSA-8883-9W57-VWV6...

vantuz (>=3.3.2 <=3.3.7) potentially affected by unknown CVE via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: unknown CVE Source advisory: OSV:GHSA-PPWQ-6V66-5M6J...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35648 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35648 Source advisory: OSV:GHSA-WJ55-88GF-X564...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-35650 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-35650 Source advisory: OSV:GHSA-39PP-XP36-Q6MG...