Malicious code in svelte-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de19bce1fef8c7cc16b9066720070e2181816e07551ecd8435baea09c607ed6 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicative of credential theft, install-time code executio...

DEBIAN-CVE-2026-16417

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-16417

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-16417

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-16417

Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-16417

A vulnerability exists in the Skia graphics library used by Google Chrome and Microsoft Edge browsers. The root cause is an uninitialized use of variables, which allows a remote attacker who has already compromised the renderer process to leak cross-origin data via a crafted HTML page. While some...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the extractItem process. An attacker can write arbitrary files outside the intended directory by crafting a malicious .delta file that exploits intermediate symlinks in the extraction path. This is only exploitab...

MAL-2026-10940 Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

PT-2026-63253

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.182 Description A use-after-free issue exists in the GPU component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A...

PT-2026-63246

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description An uninitialized use in Skia allows a remote attacker who has compromised the renderer process to leak cross-origin data through a crafted HTML page. Recommendations Update Google Chro...

MAL-2026-10928 Malicious code in upjsma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6da6be7241858aacc6bf0fdef363fad9469efcbd9414b7b6e3e4153eba341f7b The package's main entry is a browser-only IIFE that, when bundled into a web page, overlays a full-screen mask, injects a fullscreen iframe, and...

MAL-2026-10924 Malicious code in s3-lambda-dynamodb-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6517c8914c4ba64ce57809484229df7fbe5dd9f5129c40b19cec8a73c10a70ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in iot-kfh-s3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...

CVE-2026-46412

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS Identity Server with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 malicious versions of @beproduct/nestjs-auth 0.1.2 through 0.1.19. The...

CVE-2026-46412

CVE-2026-46412 affects @beproduct/nestjs-auth versions 0.1.2–0.1.19. An attacker published malicious builds via a compromised npm publish token, deploying a Mini Shai-Hulud worm payload. The postinstall script harvested secrets (npm tokens from ~/.npmrc, GitHub PATs and OAuth tokens, Actions OIDC...

MAL-2026-10861 Malicious code in @gocortexio/npmgremlinbox-unlicense (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23bb2676a768ebd0e40b34368cca60d48ba7bec21c362d307e1ff87d04b3ba44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10842 Malicious code in @gocortexio/npmgremlinbox-openpbs-2-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a66e3fdf500614035fa89cb285a3a94a898e6890333031745ac4312f6e5caf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...