MAL-2026-4411 Malicious code in @onerjs/inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08c3c6c201db840a5576941656934704b0932abe72527c5e85b969fd90ad0ccd Package name, version 8.52.2, README, homepage and repository all impersonate @babylonjs/inspector. The shipped code is a 700-byte UMD wrapper that...

Malicious code in @onerjs/inspector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08c3c6c201db840a5576941656934704b0932abe72527c5e85b969fd90ad0ccd Package name, version 8.52.2, README, homepage and repository all impersonate @babylonjs/inspector. The shipped code is a 700-byte UMD wrapper that...

Malicious code in @onerjs/smart-filters-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e772d7a844409df378591a5a587c7cc8045e0ec0e8cb493912f0da8fa594c169 This package is published as @onerjs/smart-filters-blocks but its README, repository URL git+https://github.com/BabylonJS/Babylon.js.git, description...

MAL-2026-4415 Malicious code in @onerjs/smart-filters-blocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e772d7a844409df378591a5a587c7cc8045e0ec0e8cb493912f0da8fa594c169 This package is published as @onerjs/smart-filters-blocks but its README, repository URL git+https://github.com/BabylonJS/Babylon.js.git, description...

blog-coeur (>=0.0.12 <=0.0.19), chat-portal (>=0.1.0 <=0.2.1) +8 more potentially affected by unknown CVE via instagrapi (>=2.0.0 <=2.6.6)

instagrapi PYPI version =2.0.0, =0.0.12, =0.1.0, =0.0.1, =0.1.0, =1.0.0, =1.3.7, =0.1.0, =0.1.0, =2.2.0, =1.0.2, =2.8.50 Source cves: unknown CVE Source advisory: OSV:GHSA-GGXF-37HM-9WQF...

@bigegg/parse-server-schema-config (>=1.0.5 <=1.0.10), @kontaa/subgraph (>=1.0.1 <=1.2.3) +27 more potentially affected by CVE-2026-47138 via parse-server (>=2.0.8 <=7.5.4)

parse-server NPM version =2.0.8, =1.0.5, =1.0.1, =1.2.1, =2.4.46, =2.4.8, =1.0.0, =1.0.0, =1.0.1, =0.1.1, =0.0.2, =1.0.0, =0.1.0, =0.1.7, =0.0.1, =0.0.29 - parse-cli-server2 =0.0.30 and more Source cves: CVE-2026-47138 Source advisory: OSV:GHSA-38M6-82C8-4XFM...

org.apache.camel:camel-example-cxf (>=2.14.0 <=2.19.5), org.apache.cxf.osgi.itests:org.apache.cxf.osgi.itests (>=3.0.0 <=3.6.10) +17 more potentially affected by CVE-2025-48913 +1 more via org.apache.cxf:cxf-rt-transports-jms (>=3.0.0-milestone1 <=3.6.10)

org.apache.cxf:cxf-rt-transports-jms MAVEN version =3.0.0-milestone1, =2.14.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.0, =5.0.0.Beta1, =5.0.0.Beta1, =5.0.0.Beta1, =5.0.0.Beta1, =5.5.0.Final and more Source cves: CVE-2025-48913, CVE-2026-44417 Source advisory:...

org.webjars.npm:github-com-wavesoft-local-echo (=0.2.0), org.webjars.npm:launch-editor (=2.2.1) +2 more potentially affected by CVE-2026-9277 via org.webjars.npm:shell-quote (=1.8.3)

org.webjars.npm:shell-quote MAVEN version =1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:shell-quote and may be impacted: - org.webjars.npm:github-com-wavesoft-local-echo =0.2.0 - org.webjars.npm:launch-editor =2.2.1 -...

-tompan-reacttemplate (>=1.0.1 <=1.1.0), 0726react (=0.1.1) +28725 more potentially affected by CVE-2026-9277 via shell-quote (>=1.3.3 <=1.8.3)

shell-quote NPM version =1.3.3, =1.0.1, =1.1.0 - 0726react =0.1.1 - 0x0.icu.anima =0.1.0 - 0xcorde-pac =1.0.0 - 0xgank-tea-advice-pull =1.0.0 - 0xgank-tea-balance-pencil =1.0.0 - 0xgank-tea-brick-bell =1.0.0 - 0xgank-tea-cake-victory =1.0.0 - 0xgank-tea-central-compound =1.0.0 -...

01os (>=0.0.1 <=0.0.14), 2025-assignment2-expenses-manager (>=0.1.1 <=0.1.7) +4866 more potentially affected by CVE-2026-48710 via starlette (>=0.20.2 <=1.0.0rc1)

starlette PYPI version =0.20.2, =0.0.1, =0.1.1, =0.5.3, =0.3.6, =0.12.0, =0.4.2, =0.1.10, =0.0.1, =0.1.0, =0.1.3, =0.0.1, =0.1.5, =0.1.1, =0.1.9 and more Source cves: CVE-2026-48710 Source advisory: OSV:PYSEC-2026-161...

01os (>=0.0.1 <=0.0.14), 0xpwn (=0.1.1) +810 more potentially affected by CVE-2026-47101 via litellm (>=1.0.0 <=1.83.13)

litellm PYPI version =1.0.0, =0.0.1, =0.0.14, =0.0.14, =0.0.1a0, =0.3.5, =0.6.0, =0.7.3, =0.1.0, =0.4.0, =0.8.1, =0.1.0, =0.1.39, =0.2.1, =0.2.1.10102025 - agent-memory-server =0.15.0 and more Source cves: CVE-2026-47101 Source advisory: SNYK:PYTHON-LITELLM-16795355...

@bitsocial/ai-moderation-challenge (>=0.1.0 <=0.1.1), @bitsocial/bitsocial-cli (>=0.19.44 <=0.19.71) +6 more potentially affected by CVE-2026-46679 via @libp2p/gossipsub (>=15.0.0-049bfa0fa <=15.0.23-3574648c3)

@libp2p/gossipsub NPM version =15.0.0-049bfa0fa, =0.1.0, =0.19.44, =0.1.0, =0.1.0, =0.1.0, =6.0.0-049bfa0fa, =9.0.0-049bfa0fa, =0.0.17, =0.0.45 Source cves: CVE-2026-46679 Source advisory: SNYK:JS-LIBP2PGOSSIPSUB-16798774...

ara-cli (>=0.1.14.13 <=0.1.14.14), clai (>=1.5.0 <=1.98.0) +47 more potentially affected by CVE-2026-46678 via pydantic-ai-slim (>=1.56.0 <=1.98.0)

pydantic-ai-slim PYPI version =1.56.0, =0.1.14.13, =1.5.0, =0.1.0a1, =0.0.400, =1.0.0, =1.0.3, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-46678 Source advisory: OSV:GHSA-CQP8-FCVH-X7R3...

ara-cli (>=0.1.14.13 <=0.1.14.14), clai (>=1.5.0 <=1.98.0) +47 more potentially affected by CVE-2026-25580 +1 more via pydantic-ai-slim (>=1.56.0 <=1.98.0)

pydantic-ai-slim PYPI version =1.56.0, =0.1.14.13, =1.5.0, =0.1.0a1, =0.0.400, =1.0.0, =1.0.3, =0.1.0, =0.1.1, =0.1.1, =0.1.0, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-25580, CVE-2026-46678 Source advisory: SNYK:PYTHON-PYDANTICAISLIM-16796278...

arpakitlib (>=1.9.5 <=1.9.50), blog-coeur (>=0.0.14 <=0.0.19) +8 more potentially affected by CVE-2026-46645 via sqladmin (>=0.13.0 <=0.24.0)

sqladmin PYPI version =0.13.0, =1.9.5, =0.0.14, =0.0.1, =0.0.22, =0.0.1a1, =0.0.1, =0.1.0, =0.1.2, =0.0.21, =0.0.23 Source cves: CVE-2026-46645 Source advisory: OSV:GHSA-54MC-GGHV-4CFJ...

@toolsdk.ai/registry (=1.0.83), easy-mcp-server (>=1.0.117 <=1.0.118) potentially affected by CVE-2026-46519 via mcp-server-kubernetes (>=2.4.3 <=2.9.9)

mcp-server-kubernetes NPM version =2.4.3, =1.0.117, =1.0.118 Source cves: CVE-2026-46519 Source advisory: OSV:GHSA-CR22-WJX7-2W6M...

nimiq-block-production (>=0.1.0 <=0.2.0), nimiq-client (>=0.1.0 <=0.2.0) +6 more potentially affected by CVE-2026-46543 via nimiq-blockchain (>=0.1.0 <=0.2.0)

nimiq-blockchain CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-46543 Source advisory: OSV:GHSA-VGHX-352F-93JM...

nimiq-account (>=0.1.0 <=0.2.0), nimiq-accounts (>=0.1.0 <=0.2.0) +17 more potentially affected by CVE-2026-46542 via nimiq-keys (>=0.1.0 <=0.2.0)

nimiq-keys CARGO version =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-46542 Source advisory: OSV:GHSA-H9CC-W26M-J342...

amzn-nova-customization-sdk (>=1.0.29 <=1.0.72), autogluon-cloud (>=0.1.1b20230324 <=0.2.1b20231219) +19 more potentially affected by CVE-2026-8597 via sagemaker (>=2.199.0 <=2.254.1)

sagemaker PYPI version =2.199.0, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.0, =0.1.1, =0.9.0, =2.1.0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.7.3, =0.4.6, =0.4.0, =0.5.5 and more Source cves: CVE-2026-8597 Source advisory: SNYK:PYTHON-SAGEMAKER-16795363...

amzn-nova-customization-sdk (>=1.0.29 <=1.0.72), autogluon-cloud (>=0.1.1b20230324 <=0.2.1b20231219) +19 more potentially affected by CVE-2026-8597 via sagemaker (>=2.199.0 <=2.254.1)

sagemaker PYPI version =2.199.0, =1.0.29, =0.1.1b20230324, =0.4.6, =0.1.0, =0.1.1, =0.9.0, =2.1.0, =2.0.0, =1.0.0, =1.0.0, =0.4.0, =0.7.3, =0.4.6, =0.4.0, =0.5.5 and more Source cves: CVE-2026-8597 Source advisory: OSV:GHSA-RQ6V-X3J8-7QGF...