Malicious Package

Overview @jonusnattapong/claudecode is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-57495

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...

CVE-2026-57495: Missing Authentication for Critical Function

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...

@agenticmail/api (>=0.6.0, <=0.7.21), @agenticmail/cli (>=0.6.0, <=0.8.36) potentially affected by unknown CVE via @agenticmail/claudecode (0.1.17)

@agenticmail/claudecode NPM version 0.1.17 is affected by a known vulnerability. The following packages have a transitive dependency on @agenticmail/claudecode and may be impacted: - @agenticmail/api =0.6.0, =0.6.0, =0.8.36 Source cves: unknown CVE Source advisory:...

@agenticmail/api (>=0.6.0, <=0.7.21), @agenticmail/cli (>=0.6.0, <=0.8.36) potentially affected by CVE-2026-57495 via @agenticmail/claudecode (0.1.17)

@agenticmail/claudecode NPM version 0.1.17 is affected by a known vulnerability. The following packages have a transitive dependency on @agenticmail/claudecode and may be impacted: - @agenticmail/api =0.6.0, =0.6.0, =0.8.36 Source cves: CVE-2026-57495 Source advisory: OSV:GHSA-FQ4X-789W-JG5H...

Missing Authentication for Critical Function

Overview @agenticmail/claudecode is a Claude Code integration for AgenticMail — surfaces every AgenticMail agent as a native Claude Code subagent so any Claude Code session can delegate to them with the Agent tool Affected versions of this package are vulnerable to Missing Authentication for...

@agenticmail/api (>=0.6.0, <=0.7.21), @agenticmail/claudecode (>=0.1.0, <=0.1.17) +1 more potentially affected by CVE-2026-50287 via @agenticmail/mcp (>=0.6.2, <=0.7.9)

@agenticmail/mcp NPM version =0.6.2, =0.6.0, =0.1.0, =0.6.0, =0.8.36 Source cves: CVE-2026-50287 Source advisory: SNYK:JS-AGENTICMAILMCP-17751067...

CVE-2025-15060

The CVE-2025-15060 vulnerability affects claude-hovercraft through the executeClaudeCode method, enabling Command Injection and Remote Code Execution. The flaw arises from insufficient validation of a user-supplied string before executing a system call, allowing an attacker to run arbitrary code ...