CVE-2026-28500

A flaw was found in Open Neural Network Exchange ONNX, an open standard for machine learning interoperability. A security control bypass exists in the onnx.hub.load function due to improper logic in its repository trust verification. An attacker can exploit this by providing a malicious model,...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +221 more potentially affected by unknown CVE via h3 (>=1.0.1, <=1.15.5)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.2.1, =3.1.0-0, =3.2.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-H3-15683856...

@adpush/start (>=1.87.14, <=1.87.16), @akkuma/vinxi (0.3.12) +221 more potentially affected by CVE-2026-33128 via h3 (>=1.0.1, <=1.15.5)

h3 NPM version =1.0.1, =1.87.14, =1.0.7, =1.0.0, =1.5.0, =1.0.0, =0.8.16-canary.v20250123185645, =8.3.3, =3.1.0, =0.0.11, =3.2.1, =3.1.0-0, =3.2.0 and more Source cves: CVE-2026-33128 Source advisory: SNYK:JS-H3-15692480...

Malicious code in dotenvx-int (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 353c7d76c07eade885f2ae9f5d2b6c763f3238a7200901cf48a3f00f3b74d048 The package dotenvx-int was found to contain malicious code...

Malicious code in chain-promised-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905259914ab893ce8ca6d455af186ca553bb76d253657ea9f38457798519c708 The package chain-promised-cli was found to contain malicious code...

MAL-2026-1690 Malicious code in chain-promised-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 905259914ab893ce8ca6d455af186ca553bb76d253657ea9f38457798519c708 The package chain-promised-cli was found to contain malicious code...

Malicious code in chain-promised-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9260393814045a3ce0ce9a27ff97fffcbaad7b38ad91f54d8cad995c3deb43af The package chain-promised-async was found to contain malicious code...

MAL-2026-1689 Malicious code in chain-promised-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9260393814045a3ce0ce9a27ff97fffcbaad7b38ad91f54d8cad995c3deb43af The package chain-promised-async was found to contain malicious code...

Malicious code in chain-promised (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fd6ee3247632a88a25b8059314727f1757ed1163081b133945fbe4af59e5d28 The package chain-promised was found to contain malicious code...

Malicious code in chain-cli-promised (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f7e399daf13fda688fc1a6bb911c0bf7582ef52fff3eb5af58fbd8c0934b88a The package chain-cli-promised was found to contain malicious code...

MAL-2026-1687 Malicious code in chain-cli-promised (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f7e399daf13fda688fc1a6bb911c0bf7582ef52fff3eb5af58fbd8c0934b88a The package chain-cli-promised was found to contain malicious code...

MAL-2026-1688 Malicious code in chain-promised (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fd6ee3247632a88a25b8059314727f1757ed1163081b133945fbe4af59e5d28 The package chain-promised was found to contain malicious code...

Malicious code in chain-argon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ee1203bf0112eb0f499bffaaaaa84264b875f83e282b54ec6749fe9230baf2 The package chain-argon was found to contain malicious code...

MAL-2026-1686 Malicious code in chain-argon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ee1203bf0112eb0f499bffaaaaa84264b875f83e282b54ec6749fe9230baf2 The package chain-argon was found to contain malicious code...

Malicious code in chai-chai-chain-promised (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05be57049f1ed27fc157d4893925be0d06323a7b47e8b8893ff0c353e5ddb82d The package chai-chai-chain-promised was found to contain malicious code...

MAL-2026-1676 Malicious code in chai-chai-chain-promised (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05be57049f1ed27fc157d4893925be0d06323a7b47e8b8893ff0c353e5ddb82d The package chai-chai-chain-promised was found to contain malicious code...

Malicious code in chai-await-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee42e0ab59b1093e2cb5da46d6e015073bbae0cba06eb9a0720df44e54c9c111 The package chai-await-chain was found to contain malicious code...

MAL-2026-1673 Malicious code in chai-await-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee42e0ab59b1093e2cb5da46d6e015073bbae0cba06eb9a0720df44e54c9c111 The package chai-await-chain was found to contain malicious code...

Malicious code in @emerald-react/avatar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3683097454908b17afa3726cc9519d1e62c51f5b8932235470cbf0efcfb27099 The package @emerald-react/avatar was found to contain malicious code...

Claude Code Security and Magecart: Getting the Threat Model Right

When a Magecart payload hides inside the EXIF data of a dynamically loaded third-party favicon, no repository scanner will catch it – because the malicious code never actually touches your repo. As teams adopt Claude Code Security for static analysis, this is the exact technical boundary where AI...