Malicious code in svelte-map-visual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...

Malicious code in cors-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e391c8883796e10e6d74a96311f18f2a083b2745a6bd6cae8a3d7acc61d277 The CommonJS entry src/index.cjs exports getPlugin, which performs an HTTPS GET to the hardcoded host astonishing-torrone-ffb31e.netlify.app with TLS...

Malicious code in accounts-final-form (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e67b952090179c0e7ed57045bf117d0cc14ca7d832ddce2963c4f2049b66bb Requiring accounts-final-form auto-runs setup.js via process.nextTickbootstrap in index.js. setup.js selects a platform-specific asset path...

MAL-2026-11506 Malicious code in beaver-ui-date-range-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 744905f86e776fde6075a23e40274b0d4798bbb835114506926e0799430c24ba [email protected] declares a postinstall hook node setup.js and additionally triggers the same script from index.js via try...

Malicious code in lifestyle-test-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 804725b6316960d5192b9b46ab823b4bd67f5b15774d1acf1a770a57cfbae84b On require of lifestyle-test-utils, index.js loads ext.js which selects a platform-specific asset, downloads a binary from one of three Cloudflare...

Malicious code in @meli-testing/jest-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4a676fda55082dfbd3f6cb792419d9e7156f49a8c587526a37edf9cb09f535d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11452 Malicious code in @sw-commons-components/message-upsell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee504d58bc907a09044cba70345cf7bc8cf2266c20833ce8bae2866b205208c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11474 Malicious code in paraglide-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22f62eaf75227ca79ee8d113b790e60589d2f29204db3e6f3939e3dd3c7527cf Package name closely resembles the widely used @inlang/paraglide-js i18n library, but the declared main entry index.js is only a helloWorld stub. The...

CVE-2026-34490

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...

CVE-2026-34490 XAAP Android Data Stored in Unencrypted Database

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...

Malicious code in scketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eb88342ad8df3fb45f8f72935ab75fc8c7f90f185467a741928f1c27f653cfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethers-io-ethers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d93060f754bea6c9c2c5722e253ef9599335702d72a39effe29b2b7668937dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in android-web-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5df19b4396c3027870b8afcfc6ed1d52e466f5f63187716dd1262499e3ab20b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11237 Malicious code in api-gateway-lambda-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a257fe33bb475cd07d71ded069ceec397276bdd4eecbf78b50d81bde8da769e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in imut-set (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bd7ca3cbe4743cad9e7368e601776bae62d8de0b6439b33a446efba71d12b3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @spectraltest/loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e1cb56f359fd866bba1012e19f4ced6eba1a428ab4cd7f5c9696753fb921a25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spectral-wraith (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57eb03a60917ac9bb4debf56cafa90c96dfec3aab8efc04d2c946a1ac6ffceac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11330 Malicious code in malxios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cadf321b289a01aebfd33821cffbdeeaa827aa5bf4c110eacdf26b6b7654197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11228 Malicious code in @solana-utils/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abda158dfd80788df38b2221a5a9715eb7d6bebadb9569cfc51774985f39b0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pumpdot-fun/pump-swap-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76046e38de05fa61bcbae6bc4edf1a1e6b704f7c99e4ca8e57a16bbe06380dcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...