MAL-2026-17853 Malicious code in opencode2-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c6a79212b7f12e5d4cae1e3d44b47da54ab2e77545f488b99f6f2dab8a5e638 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

reasonix (>=1.1.0-rc.1, <=1.39.2) potentially affected by CVE-2026-102437 via @reasonix/cli-darwin-arm64 (>=1.1.0-rc.1, <=1.39.2)

@reasonix/cli-darwin-arm64 NPM version =1.1.0-rc.1, =1.1.0-rc.1, =1.39.2 Source cves: CVE-2026-102437 Source advisory: MEND:CVE-2026-102437...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-darwin-arm64 (>=7.2.3, <=7.4.0)

@kilocode/cli-darwin-arm64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...

Malicious Package

Overview @postman-cse/okta-aio-darwin-arm64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

MAL-2026-14580 Malicious code in @postman-cse/okta-aio-darwin-arm64 (npm)

The package '@postman-cse/okta-aio-darwin-arm64' was identified as containing malicious obfuscated code...

Malicious code in @postman-cse/okta-aio-darwin-arm64 (npm)

The package '@postman-cse/okta-aio-darwin-arm64' was identified as containing malicious obfuscated code...

@ccfly/setup (0.1.9) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.9)

@ccfly/setup-darwin-arm64 NPM version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.9 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.2) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.2)

@ccfly/setup-darwin-arm64 NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.2 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.8) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.8)

@ccfly/setup-darwin-arm64 NPM version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.8 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.10) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.10)

@ccfly/setup-darwin-arm64 NPM version 0.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.10 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.13) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.13)

@ccfly/setup-darwin-arm64 NPM version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.13 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.14) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.14)

@ccfly/setup-darwin-arm64 NPM version 0.1.14 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.14 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.5) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.5)

@ccfly/setup-darwin-arm64 NPM version 0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.5 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.7) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.7)

@ccfly/setup-darwin-arm64 NPM version 0.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.7 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

@ccfly/setup (0.1.20) potentially affected by unknown CVE via @ccfly/setup-darwin-arm64 (0.1.20)

@ccfly/setup-darwin-arm64 NPM version 0.1.20 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-arm64 and may be impacted: - @ccfly/setup 0.1.20 Source cves: unknown CVE Source advisory: GHSA-XJ5F-XPQG-6PV6...

sextant-cli (0.0.1-rc14) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc14)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc14 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc14 Source cves: unknown CVE Source advisory: SNYK:JS-SEXTANTCLIDARWINARM64-18565227...

sextant-cli (0.0.1-rc29) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc29)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc29 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc29 Source cves: unknown CVE Source advisory: GHSA-2QG7-5P3X-VR75...

sextant-cli (0.0.1-rc35) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc35)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc35 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc35 Source cves: unknown CVE Source advisory: SNYK:JS-SEXTANTCLIDARWINARM64-18565227...

sextant-cli (0.0.1-rc8) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc8)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc8 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc8 Source cves: unknown CVE Source advisory: GHSA-2QG7-5P3X-VR75...

sextant-cli (0.0.1-rc10) potentially affected by unknown CVE via sextant-cli-darwin-arm64 (0.0.1-rc10)

sextant-cli-darwin-arm64 NPM version 0.0.1-rc10 is affected by a known vulnerability. The following packages have a transitive dependency on sextant-cli-darwin-arm64 and may be impacted: - sextant-cli 0.0.1-rc10 Source cves: unknown CVE Source advisory: GHSA-2QG7-5P3X-VR75...