MAL-2026-18244 Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b430da8eb1d9a15b74f4abfe412db5106d498cf018c3a611e2d151a993c7819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b430da8eb1d9a15b74f4abfe412db5106d498cf018c3a611e2d151a993c7819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @k18k/entrypoint-sdk-darwin-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-darwin-x64 (>=3.0.0, <=3.33.1)

@fallow-cli/fallow-node-darwin-x64 NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

code-shame (0.2.0), fallow (>=3.0.0, <=3.33.1) +1 more potentially affected by CVE-2026-115569 via @fallow-cli/darwin-x64 (>=3.0.0, <=3.33.1)

@fallow-cli/darwin-x64 NPM version =3.0.0, =3.0.0, =1.19.2, =1.24.4 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

Malicious Package

Overview @k18k/entrypoint-sdk-darwin-x64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malware in @liauto/darwin-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18190 Malicious code in @liauto/darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c28d1be2a555bd8dfb04c636fbc78a5add132fb5be0bfee0ff204a0d529f770 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liauto/darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c28d1be2a555bd8dfb04c636fbc78a5add132fb5be0bfee0ff204a0d529f770 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @liauto/darwin-x64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CLSA-2026-1792161655 TuxCare security update for @esbuild/darwin-x64 (1 CVE)

TuxCare rebuilt @esbuild/darwin-x64 to address 1 CVE. Fixed in 0.18.20-tuxcare.1...

CLSA-2026-1792161064 TuxCare security update for @rollup/rollup-darwin-x64 (1 CVE)

TuxCare rebuilt @rollup/rollup-darwin-x64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1...

PT-2026-123728

TuxCare rebuilt @rollup/rollup-darwin-x64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1...

PT-2026-124208

TuxCare rebuilt @esbuild/darwin-x64 to address 1 CVE. Fixed in 0.18.20-tuxcare.1...

Malware in opencode2-darwin-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in opencode2-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5536c7ac30ec68d1e8ab9f64da77fa154f6d1806df263ad0abaf3af38ab0e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17854 Malicious code in opencode2-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5536c7ac30ec68d1e8ab9f64da77fa154f6d1806df263ad0abaf3af38ab0e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview opencode2-darwin-x64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

reasonix (>=1.1.0-rc.1, <=1.39.2) potentially affected by CVE-2026-102437 via @reasonix/cli-darwin-x64 (>=1.1.0-rc.1, <=1.39.2)

@reasonix/cli-darwin-x64 NPM version =1.1.0-rc.1, =1.1.0-rc.1, =1.39.2 Source cves: CVE-2026-102437 Source advisory: MEND:CVE-2026-102437...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-darwin-x64 (>=7.2.3, <=7.4.0)

@kilocode/cli-darwin-x64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...