MAL-2026-2168 Malicious code in chai-patch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7a1b00f9cf8ff93aebfbb318e0f4da8d56a985a1eca3c305142e708dc6fc55 The package chai-patch was found to contain malicious code. Source: ghsa-malware a5b659f5744d677c50cb63bc98f750071b3db390e25b81a553debdff48ffac6a Any...

Malicious code in @rexxtheproject/elaina-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35f9ef0d26d553f66ecfe3fb2813906a4a457ec3918fb5c0508441f3e13d3fa4 The package @rexxtheproject/elaina-baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2165 Malicious code in @rexxtheproject/keyed-db (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa8d0778ab610c5b6e2320997c2427bf9e6295b93fe16ae478096953c1de9b34 The package @rexxtheproject/keyed-db was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2163 Malicious code in @rexxtheproject/elaina-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35f9ef0d26d553f66ecfe3fb2813906a4a457ec3918fb5c0508441f3e13d3fa4 The package @rexxtheproject/elaina-baileys was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-as-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bcf6b93b6186112457361f81d21c00830bf0c48c75763de88d97f1b075944cf The package chai-as-chain was found to contain malicious code. Source: ghsa-malware 1d06397b7e66c2a8ecf1542a1f7d18b0f5a87d08a276dc88f77b1f8b2d818d47...

Malicious code in @eric-orderbuddyinfo/react-noval (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5f280b7537acc7eb9e1d8c12acdd2142bb02e391be55b2157ed90eb2044d06 The package @eric-orderbuddyinfo/react-noval was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2162 Malicious code in svg-sizer-responsive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a60820b0fbec756691b147e45ad8157501c307c7864249a6a7b112b5293846e The package svg-sizer-responsive was found to contain malicious code. Source: ghsa-malware...

Malicious code in svg-sizer-responsive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a60820b0fbec756691b147e45ad8157501c307c7864249a6a7b112b5293846e The package svg-sizer-responsive was found to contain malicious code. Source: ghsa-malware...

Malicious code in pino-pretty-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2a9c035f47cbd6beb9e2f47299a689f13823a21eaef04fd6abfa9035dcb120e The package pino-pretty-log was found to contain malicious code. Source: ghsa-malware 5ddd0444ff8834bc42162fb1d88cf6d71f6044c2a636cde204484f654ce6589...

MAL-2026-2156 Malicious code in tailwind-animationbasis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 613bfa904c0195c7d59209123554b2be83ed4a0568c174e8b221e22725fec103 The package tailwind-animationbasis was found to contain malicious code. Source: ghsa-malware...

SUSE CVE-2026-33634

Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious...

MAL-2026-2153 Malicious code in @xvortexsockets/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6fe781d4e79519992d2b0f37577515da41d7e0deb2f9f32df7c39dfb8de3916 The package @xvortexsockets/baileys was found to contain malicious code. Source: ghsa-malware...

PT-2026-35859

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.138 Description A use after free issue in ANGLE allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Use after free...

Trivy ecosystem supply chain was briefly compromised

Summary On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. On March 22...

EUVD-2026-14601

Trivy ecosystem supply chain was briefly compromised...

GHSA-69FQ-XP46-6X23 Trivy ecosystem supply chain was briefly compromised

Summary On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in aquasecurity/trivy-action to credential-stealing malware, and replace all 7 tags in aquasecurity/setup-trivy with malicious commits. On March 22...

MAL-2026-2128 Malicious code in express-session-vailidator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 559c32a7f4713a1d785b35766355cf1a29ef437a0dc8e5285b980c9611175cff The package express-session-vailidator was found to contain malicious code. Source: ghsa-malware...

Malicious code in agoda-test-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61298c02c98b568b7b2735848ed2087ced94165a58e6602af9769d359b279056 The package agoda-test-poc was found to contain malicious code. Source: ghsa-malware f1dc100458bb8a2a4c1831d2a680b7895085adc4bb5fa5c90701f52b1165eb8d...

MAL-2026-2127 Malicious code in agoda-test-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61298c02c98b568b7b2735848ed2087ced94165a58e6602af9769d359b279056 The package agoda-test-poc was found to contain malicious code. Source: ghsa-malware f1dc100458bb8a2a4c1831d2a680b7895085adc4bb5fa5c90701f52b1165eb8d...

MAL-2026-2136 Malicious code in yelp-react-component-rating (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027bbca928c4c1696f388fbb2ac0ac3a7c74a29db1a6bb76b5c7431759c27421 The package yelp-react-component-rating was found to contain malicious code. Source: ghsa-malware...