@bitblit/ratchet-aws-node-only (>=6.1.196-alpha, <=6.1.200-alpha), @bitblit/ratchet-epsilon-common (>=6.1.196-alpha, <=6.1.200-alpha) +70 more potentially affected by CVE-2026-82853 via nodemailer (>=8.0.0, <=8.0.4)

nodemailer NPM version =8.0.0, =6.1.196-alpha, =6.1.196-alpha, =6.1.196-alpha, =0.0.1, =3.35.0, =4.0.0-canary.13686, =4.0.0-canary.13686, =20.6.0, =5.0.10, =0.0.1-beta.0, =0.2.0-alpha.1, =0.19.1, =5.8.38, =5.8.40 and more Source cves: CVE-2026-82853 Source advisory: OSV:GHSA-VVJJ-XCJG-GR5G...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @agentforce/adk (>=0.9.0, <=0.12.1) +546 more potentially affected by CVE-2026-39408 via hono (>=4.0.0, <=4.12.10)

hono NPM version =4.0.0, =0.3.1, =0.9.0, =0.1.9, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.0.1, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.78, =2.0.0-beta.66, =0.0.1, =0.0.1, =1.0.0 and more Source cves: CVE-2026-39408 Source advisory: OSV:GHSA-XF4J-XP2R-RQQX...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...

3loc (>=0.2.0, <=0.4.0), @zambezi/ez-doc (1.0.0-prepare-for-open-source.1) +41 more potentially affected by CVE-2016-10547 via nunjucks (>=2.0.0, <=2.4.2)

nunjucks NPM version =2.0.0, =0.2.0, =0.4.0, =1.0.0, =0.0.7, =0.0.4, =0.0.2, =2.0.0-alpha.1, =0.3.0, =2.3.0-beta, =1.0.0, =1.0.3, =1.0.4 and more Source cves: CVE-2016-10547 Source advisory: OSV:GHSA-F7PH-P5RV-PHW2...