17673 matches found
MAL-2026-15903 Malicious code in tailwind-container-queries (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...
Malicious code in tailwind-container-queries (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278291029e314675a40ad0fe4f76dc20dc37cdf09ce13f0769f4fc4ff0f750f On require of the package main, an appended evalatob... block in dist/index.js queries Ethereum RPC endpoints eth.blockscout.com/api, 1rpc.io/eth for...
Malicious code in @grab-food/order-sdk-web (npm)
Source: amazon-inspector aa9b56bb1d69dc16b6095faea196af99809ad805b400a3c6b5499f896c8d74c2 Package published under a scope impersonating the Grab food-ordering brand with no real functionality index.js exports an empty object. Its sole dependency, [email protected], is pinned to ...
Malicious code in @bx-ui-framework/authentication (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...
Malicious code in @bx-ui-framework/microfrontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30 package.json declares a runtime dependency microfrontend whose source is a bare HTTPS URL at...
Malicious code in @bx-ui-framework/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b8886bf47df30ba72e888647d651e72defd41c1172a4307c438562183d7a32 package.json declares a dependency whose key equals the package's own name @bx-ui-framework/common and whose value is a bare HTTPS URL...
CLEANSTART-2026-RD72054 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log
Multiple security vulnerabilities affect the grype-fips package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. See references for individual vulnerability details...
Malicious code in prime-coding-agent (npm)
The npm package prime-coding-agent is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. It is a pure-JS proxy dist/index.js: it reads the developer's provider API keys e.g. process.env.EXAAPIKEY, NVIDIAAPIKEY, configured provider...
Malicious code in agent-free (npm)
The npm package agent-free is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes t...
MAL-2026-16012 Malicious code in orbitron-cli (npm)
The npm package orbitron-cli is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...
Malicious code in orbitron-cli (npm)
The npm package orbitron-cli is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...
PT-2026-91407
Summary validateCertificatePath does not verify that an attestation's certificate chain actually terminates at a configured trust anchor. When walking the chain it stops at the first self-signed certificate it finds which could be user-supplied, and exits early. This happens before the configured...
MAL-2026-15872 Malicious code in @a23842/dsh-notifier (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e90a9b8f9d25fdfb423c0110bb478302a429e4746efa54bdabb2885bc4e8bce The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
muad-dib v2.12.0
Installation | Usage | Features | VS Code | CI/CD Version francaise Why MUAD'DIB? npm and PyPI supply-chain attacks are exploding. Shai-Hulud compromised 25K+ repos in 2025. Existing tools detect threats but don't help you respond. MUAD'DIB combines 22 parallel scanners 278 detection rules, a...
Malicious code in @quantixfinance/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...
Malicious code in @quantixfinance/wallet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18cabdbe5d59eb5064ea44a0a73db01d23affa7975049251454f599210aa79e3 The package advertises itself as a wallet library but ships a 67-byte no-op index.js; the entire payload is a preinstall lifecycle script that fires...
MAL-2026-15857 Malicious code in @quantixfinance/wallet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18cabdbe5d59eb5064ea44a0a73db01d23affa7975049251454f599210aa79e3 The package advertises itself as a wallet library but ships a 67-byte no-op index.js; the entire payload is a preinstall lifecycle script that fires...
Malicious code in @quantixfinance/api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains...
sbomlyze v0.5.3
sbomlyze git diff for your SBOM. Compare two Software Bills of Materials and see what changed between builds, versions, and releases. sbomlyze compares component hashes, not only version strings. When an attacker swaps a package without bumping its version, sbomlyze flags it. Generators and...
CVE-2026-85169
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototyp...