MAL-2026-18244 Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd94f9aefc7090d1260bb8123fd1bd78f4fd973b9d00c2423fbc13ea9799699b Package @k18k/[email protected] is a darwin-x64 platform-specific sub-package, following the standard npm pattern for distributing...

Malicious code in @k18k/entrypoint-sdk-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd94f9aefc7090d1260bb8123fd1bd78f4fd973b9d00c2423fbc13ea9799699b Package @k18k/[email protected] is a darwin-x64 platform-specific sub-package, following the standard npm pattern for distributing...

Malware in @k18k/entrypoint-sdk-darwin-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-darwin-x64 (>=3.0.0, <=3.33.1)

@fallow-cli/fallow-node-darwin-x64 NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

code-shame (0.2.0), fallow (>=3.0.0, <=3.33.1) +1 more potentially affected by CVE-2026-115569 via @fallow-cli/darwin-x64 (>=3.0.0, <=3.33.1)

@fallow-cli/darwin-x64 NPM version =3.0.0, =3.0.0, =1.19.2, =1.24.4 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

Malicious Package

Overview @k18k/entrypoint-sdk-darwin-x64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious code in @liauto/darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7908d3c29504b802e6f8e6b53e9fdc9062f8f4c1129ba6cf2966908729faee95 @liauto/darwin-x64 is a platform-specific darwin-x64 distribution package, typical of the optionalDependencies pattern used to ship prebuilt native...

MAL-2026-18190 Malicious code in @liauto/darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7908d3c29504b802e6f8e6b53e9fdc9062f8f4c1129ba6cf2966908729faee95 @liauto/darwin-x64 is a platform-specific darwin-x64 distribution package, typical of the optionalDependencies pattern used to ship prebuilt native...

Malware in @liauto/darwin-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview @liauto/darwin-x64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CLSA-2026-1792161655 TuxCare security update for @esbuild/darwin-x64 (1 CVE)

TuxCare rebuilt @esbuild/darwin-x64 to address 1 CVE. Fixed in 0.18.20-tuxcare.1...

CLSA-2026-1792161064 TuxCare security update for @rollup/rollup-darwin-x64 (1 CVE)

TuxCare rebuilt @rollup/rollup-darwin-x64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1...

PT-2026-123728

TuxCare rebuilt @rollup/rollup-darwin-x64 to address 1 CVE. Fixed in 4.22.4-tuxcare.1...

PT-2026-124208

TuxCare rebuilt @esbuild/darwin-x64 to address 1 CVE. Fixed in 0.18.20-tuxcare.1...

Malware in opencode2-darwin-x64

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17854 Malicious code in opencode2-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5536c7ac30ec68d1e8ab9f64da77fa154f6d1806df263ad0abaf3af38ab0e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opencode2-darwin-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5536c7ac30ec68d1e8ab9f64da77fa154f6d1806df263ad0abaf3af38ab0e378 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview opencode2-darwin-x64 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

reasonix (>=1.1.0-rc.1, <=1.39.2) potentially affected by CVE-2026-102437 via @reasonix/cli-darwin-x64 (>=1.1.0-rc.1, <=1.39.2)

@reasonix/cli-darwin-x64 NPM version =1.1.0-rc.1, =1.1.0-rc.1, =1.39.2 Source cves: CVE-2026-102437 Source advisory: MEND:CVE-2026-102437...

@kilocode/cli (>=7.2.3, <=7.4.0) potentially affected by CVE-2026-79403 via @kilocode/cli-darwin-x64 (>=7.2.3, <=7.4.0)

@kilocode/cli-darwin-x64 NPM version =7.2.3, =7.2.3, =7.4.0 Source cves: CVE-2026-79403 Source advisory: MEND:CVE-2026-79403...