466 matches found
CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow
Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...
CVE-2026-63187
Logto (open-source auth infrastructure) versions 1.40.1 through 1.41.0 contain an OS command injection in the .github/workflows/commitlint.yml workflow. The github.event.pull_request.title value was directly interpolated into an inline echo command before being piped to npx commitlint. A pull req...
Malicious code in @ornikar/commitlint-config (npm)
npm/@ornikar/commitlint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @voiceflow/commitlint-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0318a598c3e523953b57c870305c3d1237a290a253f3d69dd9f24bf6ba079d6e The package @voiceflow/commitlint-config was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-199423
Malicious code in @voiceflow/commitlint-config npm...
EUVD-2025-180478
Malicious code in airbnb-oscillation-commitlint-config-angular-palynology npm...
EUVD-2025-179636
Malicious code in commitlint-chalk-eclipse-init npm...
EUVD-2025-180329
Malicious code in ariel-callisto-commitlint-config-angular-install npm...
EUVD-2025-179628
Malicious code in commitlint-prosthetics-altair-magnetosphere npm...
EUVD-2025-177567
Malicious code in node-sass-commitlint-lynx-public npm...
EUVD-2025-178516
Malicious code in holography-commitlint-xml-unuk npm...
EUVD-2025-180113
Malicious code in bellatrix-mira-europa-commitlint npm...
EUVD-2025-177496
Malicious code in octans-buffer-commitlint-config-angular-puppeteer npm...
EUVD-2025-176558
Malicious code in sagitta-polaris-configstore-commitlint-config-angular npm...
Malicious code in commitlint-resolvers-procyon-pm2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c84a42a0bd7b27857197441ce982e9035d4e93ebf009d7bb23942627d9ce0b70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in commitlint-config-angular-nodejs-carpo-vortex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff6171864c8dd888f734cabf61ae22f26f3868044dd59eb396032310cdbcf72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176917
Malicious code in publish-superagent-rollup-plugin-commitlint npm...
EUVD-2025-179627
Malicious code in commitlint-publish-fornax-prettier-stylelint npm...