CLSA-2026-1792160967 TuxCare security update for @babel/plugin-proposal-numeric-separator (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-numeric-separator to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792160966 TuxCare security update for @babel/plugin-proposal-nullish-coalescing-operator (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-nullish-coalescing-operator to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

ROOT-APP-NPM-CVE-2026-44728 CVE-2026-44728 in @babel/plugin-transform-modules-systemjs - Patched by Root

Root has patched CVE-2026-44728 in the @babel/plugin-transform-modules-systemjs package for Root:npm. Multiple fixed versions available...

RCE (Remote Code Execution) @babel/plugin-transform-modules-systemjs Dependency in Jira Software Data Center

This High severity RCE Remote Code Execution vulnerability was introduced in versions 9.17.2, 10.0.0, 10.1.1, 10.3.20, and 11.3.8 of Jira Software Data Center. This RCE Remote Code Execution vulnerability, with a CVSS Score of 8.2 and a CVSS Vector of CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H...

Malicious code in better-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 302c3b7766a431cefe81d41434fd4c5aae74aacec230488bd004eca18cbe8dff The package publishes under the name of the legitimate better-tailwindcss project but its package.json declares both a runtime and dev dependency on...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +334 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: MEND:CVE-2026-44728...

CVE-2026-44728

CVE-2026-44728 affects Babel, a JavaScript compiler. Vulnerability occurs when compiling code that is specifically crafted by an attacker, enabling output code to execute arbitrary code. Affects Babel versions 7.12.0 through before 7.29.4 and 8.0.0-alpha.13. Root cause is the generation of advers...

MAL-2026-4129 Malicious code in babel-plugin-version (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in babel-plugin-version (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +334 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: GHSA-FV7C-FP4J-7GWP...

@1stg/app-config (16.0.0), @1stg/babel-preset (5.0.0) +290 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (8.0.1)

@babel/plugin-transform-modules-systemjs NPM version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @babel/plugin-transform-modules-systemjs and may be impacted: - @1stg/app-config 16.0.0 - @1stg/babel-preset 5.0.0 - @1stg/common-config 16.0.0 -...

@2kk/miniprogram-ci (>=0.0.2, <=0.0.8), @agilejs/cli (1.0.0) +334 more potentially affected by CVE-2026-44728 via @babel/plugin-transform-modules-systemjs (>=7.12.1, <=7.29.0)

@babel/plugin-transform-modules-systemjs NPM version =7.12.1, =0.0.2, =1.0.0, =7.21.4-esm.2, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.0, =2.1.0-alpha.74, =1.0.0, =1.1.5 and more Source cves: CVE-2026-44728 Source advisory: SNYK:JS-BABELPLUGINTRANSFORMMODULESSYSTEMJS-16624576...

Malicious Package

Overview babel-plugin-blocks is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2598 Malicious code in babel-plugin-fbtee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82da31ad0bc5f3d25505f208dd3be88eaff3e4054e429cbdc7601dc5e3a3d42d The package babel-plugin-fbtee was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview babel-plugin-fbtee is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in babel-plugin-fbtee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82da31ad0bc5f3d25505f208dd3be88eaff3e4054e429cbdc7601dc5e3a3d42d The package babel-plugin-fbtee was found to contain malicious code. Source: ghsa-malware...

Malicious code in babel-plugin-blocks (npm)

Malicious package due to data exfiltration via test, preinstall, and preupdate scripts in package.json using wget to send data to webhook.site. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 679960b444e4781d7276df8692808a4bc4507d29aefe943ffe4d3dfb35dcc141 The...

MAL-2026-2631 Malicious code in babel-plugin-blocks (npm)

Malicious package due to data exfiltration via test, preinstall, and preupdate scripts in package.json using wget to send data to webhook.site. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 679960b444e4781d7276df8692808a4bc4507d29aefe943ffe4d3dfb35dcc141 The...