Malicious code in tailwind-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afeb355b3088d1c03dbbb5a60c1afea5afbe3a384f50417ae6cfa7340d8c072d The package presents itself as a Tailwind CSS plugin, but its default export which runs when users register it in tailwind.config issues an HTTPS...

Malicious code in alelo-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31cdc535ad02d3d78533315ef2037d4860699d9c7a161ed96a176082824f07 [email protected] runs both preinstall and postinstall lifecycle scripts that harvest installer data and POST it to the hardcoded bare-IP endpoin...

MAL-2026-14036 Malicious code in notafollower1226 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint ECSCONTAINERMETADATAURIV4/task to...

Malicious code in notafollower1226 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc72e98071e37ff58c3bb327f995c9c586b81a22180a8004b6564026cbc629f The package.json postinstall script auto-executes on npm install. It queries the ECS container metadata endpoint ECSCONTAINERMETADATAURIV4/task to...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

CVE-2026-72826 Grav API Plugin before 1.0.13 Scope Bypass via createApiKey

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

MAL-2026-14083 Malicious code in heft-storybook-v6-react-tutorial-storykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5955868f72344703128add3301e3a85b51773de502f24e636fe0b9bba86d42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ak-mal-test-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb1e00b87448788cd84d0c30aa68374d531288859498450fe6db4ab3e2d63e42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14081 Malicious code in game_overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e941794f17bbd4170928ecfb4c2affa3b9464d9227bc5671e4899aaca4a88db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in game_overlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e941794f17bbd4170928ecfb4c2affa3b9464d9227bc5671e4899aaca4a88db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pocbitbarrontest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8730ba23c54aed5d25d755bc1f2ed8809e57cb1996b80d301a5f265a3c09052 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14091 Malicious code in pocbitbarrontest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8730ba23c54aed5d25d755bc1f2ed8809e57cb1996b80d301a5f265a3c09052 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14099 Malicious code in zip-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e9a990db9c306a25a8b0663088429ef5cf3939c32a9f8d6b1fc3066e8bf42a78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14077 Malicious code in dinotech-auth-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21556f23a2332af836a6f0c905a4391a6699a2dcd8a597c9e9955caf795333f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dinotech-auth-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21556f23a2332af836a6f0c905a4391a6699a2dcd8a597c9e9955caf795333f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14074 Malicious code in @vyzensockets/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65a38578ec3825683bc7646595c0676583ebf4bb3b5c36b5b92c5c7f4537e653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @vyzensockets/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 65a38578ec3825683bc7646595c0676583ebf4bb3b5c36b5b92c5c7f4537e653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14085 Malicious code in hrp9872 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3863301b783d96a98f60f37331d4a61f921e6dee3c5c35f8788df21da5fd549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hrp9872 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3863301b783d96a98f60f37331d4a61f921e6dee3c5c35f8788df21da5fd549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14084 Malicious code in hrp9871 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91c46b73436de569d9a4d38f72d48e9478c74ec6fc572af4c0cf7ccaa666b2ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...