CLSA-2026-1792964821 TuxCare security update for esbuild-darwin-arm64 (1 CVE)

TuxCare rebuilt esbuild-darwin-arm64 to address 1 CVE. Fixed in 0.14.54-tuxcare.4...

CLSA-2026-1792964820 TuxCare security update for esbuild-darwin-arm64 (1 CVE)

TuxCare rebuilt esbuild-darwin-arm64 to address 1 CVE. Fixed in 0.15.18-tuxcare.4...

CLSA-2026-1792964819 TuxCare security update for esbuild-darwin-arm64 (1 CVE)

TuxCare rebuilt esbuild-darwin-arm64 to address 1 CVE. Fixed in 0.15.5-tuxcare.4...

CLSA-2026-1792964818 TuxCare security update for esbuild-darwin-arm64 (1 CVE)

TuxCare rebuilt esbuild-darwin-arm64 to address 1 CVE. Fixed in 0.14.22-tuxcare.2...

CLSA-2026-1792964817 TuxCare security update for esbuild-darwin-arm64 (1 CVE)

TuxCare rebuilt esbuild-darwin-arm64 to address 1 CVE. Fixed in 0.14.25-tuxcare.2...

CLSA-2026-1792964816 TuxCare security update for esbuild-darwin-arm64 (1 CVE)

TuxCare rebuilt esbuild-darwin-arm64 to address 1 CVE. Fixed in 0.13.8-tuxcare.2...

Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d85a01dd2d613b035e2c635d3d1e4f40b81e3ee7eea6e868e6fc4175618c123 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @k18k/entrypoint-sdk-darwin-arm64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18243 Malicious code in @k18k/entrypoint-sdk-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3d85a01dd2d613b035e2c635d3d1e4f40b81e3ee7eea6e868e6fc4175618c123 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-darwin-arm64 (>=3.0.0, <=3.33.1)

@fallow-cli/fallow-node-darwin-arm64 NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

code-shame (0.2.0), fallow (>=3.0.0, <=3.33.1) +1 more potentially affected by CVE-2026-115569 via @fallow-cli/darwin-arm64 (>=3.0.0, <=3.33.1)

@fallow-cli/darwin-arm64 NPM version =3.0.0, =3.0.0, =1.19.2, =1.24.4 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

Malicious Package

Overview @k18k/entrypoint-sdk-darwin-arm64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CLSA-2026-1792161649 TuxCare security update for @esbuild/darwin-arm64 (1 CVE)

TuxCare rebuilt @esbuild/darwin-arm64 to address 1 CVE. Fixed in 0.18.20-tuxcare.1...

CLSA-2026-1792161063 TuxCare security update for @rollup/rollup-darwin-arm64 (1 CVE)

TuxCare rebuilt @rollup/rollup-darwin-arm64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1...

PT-2026-123727

TuxCare rebuilt @rollup/rollup-darwin-arm64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1...

PT-2026-124204

TuxCare rebuilt @esbuild/darwin-arm64 to address 1 CVE. Fixed in 0.18.20-tuxcare.1...

Malware in opencode2-darwin-arm64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in opencode2-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c6a79212b7f12e5d4cae1e3d44b47da54ab2e77545f488b99f6f2dab8a5e638 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17853 Malicious code in opencode2-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c6a79212b7f12e5d4cae1e3d44b47da54ab2e77545f488b99f6f2dab8a5e638 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview opencode2-darwin-arm64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...