@saltcorn/cli (>=1.5.0-beta.0, <=1.5.0), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.0) potentially affected by unknown CVE via @saltcorn/server (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/server NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-16318352...

@saltcorn/cli (>=1.6.0-alpha.0, <=1.6.0-alpha.17), @saltcorn/mobile-builder (>=1.6.0-alpha.0, <=1.6.0-alpha.17) potentially affected by unknown CVE via @saltcorn/server (>=1.6.0-alpha.0, <=1.6.0-alpha.17)

@saltcorn/server NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.17 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNSERVER-16318352...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: OSV:GHSA-9237-RG5P-RHFW...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-16318351...

@saltcorn/admin-models (>=1.0.0-beta.0, <=1.4.3), @saltcorn/base-plugin (>=1.0.0-beta.0, <=1.4.3) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.0.0-beta.0, <=1.4.3)

@saltcorn/data NPM version =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.0.0-beta.1, =1.0.0-beta.0, =1.0.0-beta.0, =1.0.0-beta.1, =1.4.3 Source cves: unknown CVE Source advisory: GHSA-9237-RG5P-RHFW...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: OSV:GHSA-9237-RG5P-RHFW...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-16318351...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.5.0-beta.0, <=1.5.0)

@saltcorn/data NPM version =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0 Source cves: unknown CVE Source advisory: GHSA-9237-RG5P-RHFW...

@saltcorn/admin-models (>=1.6.0-alpha.0, <=1.6.0-alpha.17), @saltcorn/base-plugin (>=1.6.0-alpha.0, <=1.6.0-alpha.17) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.6.0-alpha.0, <=1.6.0-alpha.17)

@saltcorn/data NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.17 Source cves: unknown CVE Source advisory: SNYK:JS-SALTCORNDATA-16318351...

@saltcorn/admin-models (>=1.6.0-alpha.0, <=1.6.0-beta.1), @saltcorn/base-plugin (>=1.6.0-alpha.0, <=1.6.0-beta.1) +5 more potentially affected by unknown CVE via @saltcorn/data (>=1.6.0-alpha.0, <=1.6.0-beta.1)

@saltcorn/data NPM version =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-alpha.0, =1.6.0-beta.1 Source cves: unknown CVE Source advisory: GHSA-9237-RG5P-RHFW...

Malware in claudcode-cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in claudcode-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1de8369f09912bb8724607f94c599ad3fcecfa78fa46e76985acbc600ad8791 The package claudcode-cli was found to contain malicious code. Source: ghsa-malware 6bdf49fafb69e5edbe0ee4aecb34c6d65f28e0dd917b228142fd71e6db486971...

MAL-2026-2973 Malicious code in claudcode-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1de8369f09912bb8724607f94c599ad3fcecfa78fa46e76985acbc600ad8791 The package claudcode-cli was found to contain malicious code. Source: ghsa-malware 6bdf49fafb69e5edbe0ee4aecb34c6d65f28e0dd917b228142fd71e6db486971...

Malicious Package

Overview claudcode-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

aztarna (1.0.0), gluetool (>=1.25.0, <=1.26.0) +4 more potentially affected by CVE-2026-41066 via lxml (4.2.4)

lxml PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - aztarna 1.0.0 - gluetool =1.25.0, =1.0.0, =1.0.0, =0.4.1, =1.4.0, =1.5.2 Source cves: CVE-2026-41066 Source advisory: OSV:GHSA-VFMQ-68HX-4JFW...

an-website (24.1.0), browserist (1.6.7) +5 more potentially affected by CVE-2026-41066 via lxml (5.0.0)

lxml PYPI version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - an-website 24.1.0 - browserist 1.6.7 - ena-upload-cli =0.6.3, =5.0.0, =0.1.0, =0.5.0 - stockplot 2.0.3 Source cves: CVE-2026-41066 Source advisory:...

http-tools (>=1.0.1, <=1.0.2), lyrebird (>=0.11.0, <=0.12.1) +2 more potentially affected by CVE-2026-40606 via mitmproxy (4.0.4)

mitmproxy PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - http-tools =1.0.1, =0.11.0, =1.2.1, =1.5.33, =1.5.41 Source cves: CVE-2026-40606 Source advisory: OSV:PYSEC-2026-92...

kraken-build (>=0.34.0, <=0.35.3), kraken-wrapper (>=0.33.2, <=0.35.3) +4 more potentially affected by CVE-2026-40606 via mitmproxy (10.4.2)

mitmproxy PYPI version 10.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on mitmproxy and may be impacted: - kraken-build =0.34.0, =0.33.2, =0.11.0, =0.0.2, =0.0.1, =0.0.3 Source cves: CVE-2026-40606 Source advisory: OSV:PYSEC-2026-92...

CVE-2026-40602 hass-cli: Handling of user-supplied Jinja2 templates

The Home Assistant Command-line interface hass-cli is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no...

CVE-2026-40602 hass-cli: Handling of user-supplied Jinja2 templates

The Home Assistant Command-line interface hass-cli is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no...