Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

@ammar_sk/shared-lib (0.0.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +32 more potentially affected by unknown CVE via @angular/router (>=20.0.0-rc.0, <=20.3.25)

@angular/router NPM version =20.0.0-rc.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =7.3.49-4369, =4.2.16-4435, =8.9.1, =8.9.1, =1.1.89, =0.0.57, =0.0.60 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0104...

AlmaLinux 9.2 [TuxCare] Security Update: maven / maven-javadoc / maven-lib / maven-openjdk11 / etc (ALMALINUX9.2:CLSA-2026:1786433114)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786433114 advisory. - Apache Maven will follow repositories that are defined in a dependency's Project Object Model pom which may be surprising to some users,...

fatcat-gpt (>=0.1.1, <=0.2.0), nle-framework-pappppx (0.1.0) potentially affected by unknown CVE via unsloth (>=2026.4.6, <=2026.5.8)

unsloth PYPI version =2026.4.6, =0.1.1, =0.2.0 - nle-framework-pappppx 0.1.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0075...

@n8n/n8n-nodes-langchain (2.40.0), n8n (2.40.0) potentially affected by unknown CVE via n8n-nodes-base (2.40.0)

n8n-nodes-base NPM version 2.40.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-nodes-base and may be impacted: - @n8n/n8n-nodes-langchain 2.40.0 - n8n 2.40.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0095...

@datastream/validate (>=0.0.4, <=0.0.38), @dearmrzhang/customs-mcp-server (>=0.1.2, <=1.1.0) +15 more potentially affected by CVE-2026-86472 via fast-uri (>=2.1.0, <=2.3.0)

fast-uri NPM version =2.1.0, =0.0.4, =0.1.2, =0.0.1, =0.0.1, =3.1.0-rc.0, =0.2.0, =0.2.0, =0.2.0, =0.0.1, =0.0.0, =1.0.0, =3.0.0, =1.7.0, =1.8.0 and more Source cves: CVE-2026-86472 Source advisory: OSV:GHSA-HRR3-GC8F-F4QJ...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +149 more potentially affected by CVE-2026-101912 via ip-address (>=10.0.1, <=10.7.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =0.3.1, =9.9.0-ruixiang.1, =3.2.27, =3.2.27, =0.0.0, =3.2.27, =1.1.0-dev-0d04f54.1, =3.3.0, =3.20.1 - @depup/express-rate-limit 8.3.2-depup.0 and more Source cves: CVE-2026-101912 Source advisory: GHSA-J6R3-76F7-8JCV...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-102277 via brace-expansion (>=1.1.0, <=1.1.16)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-102277 Source advisory: GHSA-Q2HR-2G5M-VWHR...

@activepieces/piece-google-gemini (0.1.6), @activepieces/piece-google-vertexai (0.1.2) +9 more potentially affected by CVE-2026-102278 via brace-expansion (>=2.0.0, <=2.1.4)

brace-expansion NPM version =2.0.0, =0.2.1, =1.16.0, =1.0.1, =0.0.20, =0.3.0, =0.5.4 - fluid-webdriver 1.1.2 - nx-cargo 1.0.0-alpha.2 Source cves: CVE-2026-102278 Source advisory: GHSA-QHR7-859C-M2P7...

@1amsheldon/mail-mcp (>=1.5.0, <=2.0.1), @27works/posto (>=1.0.0, <=2.0.2) +848 more potentially affected by CVE-2026-100699 via nodemailer (>=9.1.0, <=10.0.8)

nodemailer NPM version =9.1.0, =1.5.0, =1.0.0, =1.6.3, =0.3.64, =0.1.0, =1.0.2, =0.1.0, =2.0.2, =2.0.0, =0.2.2-rc.0, =1.0.5, =2.0.1, =2.0.3 and more Source cves: CVE-2026-100699 Source advisory: OSV:GHSA-G57G-F23G-4646...

@bitblit/ratchet-aws-node-only (>=6.1.226-alpha, <=6.1.231-alpha), @bitblit/ratchet-epsilon-common (>=6.1.226-alpha, <=6.1.231-alpha) +20 more potentially affected by unknown CVE via nodemailer (>=10.0.0, <=10.0.3)

nodemailer NPM version =10.0.0, =6.1.226-alpha, =6.1.226-alpha, =6.1.226-alpha, =1.3.1, =12.4.0-depup.0, =39.2.0, =0.3.0, =0.3.0, =1.14.1, =12.4.0, =0.3.0, =0.4.3 and more Source cves: unknown CVE Source advisory: GHSA-V53P-9FQP-M79J...

mbq-tokens (0.0.1), twilio (>=6.4.2a1, <=6.5.0) potentially affected by CVE-2026-102269 via pyjwt (1.5.0)

pyjwt PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - mbq-tokens 0.0.1 - twilio =6.4.2a1, =6.5.0 Source cves: CVE-2026-102269 Source advisory: OSV:GHSA-HXM8-2XGR-2P9M...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-102269 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-102269 Source advisory: GHSA-HXM8-2XGR-2P9M...

dbnd-datastage-monitor (>=1.0.4.1, <=1.0.4.3), dkcloudcommand (>=1.0.132rc1, <=1.1.270rc1) +5 more potentially affected by CVE-2026-102268 via pyjwt (1.6.1)

pyjwt PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - dbnd-datastage-monitor =1.0.4.1, =1.0.132rc1, =0.2.1, =0.1.1rc0, =0.5.3, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-102268 Source advisory:...

djangorestframework-jwt (>=1.0.2, <=1.1.1) potentially affected by CVE-2026-102268 via pyjwt (0.3.2)

pyjwt PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - djangorestframework-jwt =1.0.2, =1.1.1 Source cves: CVE-2026-102268 Source advisory: OSV:GHSA-FFC3-869F-JXW9...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-102268 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-102268 Source advisory: OSV:GHSA-FFC3-869F-JXW9...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-102267 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-102267 Source advisory: GHSA-9V7F-9G4P-FFGJ...

atlassian-jwt-auth (>=2.7.0, <=3.0.0), credential-shield-fdelgados (>=0.0.1, <=2.0.0) +11 more potentially affected by CVE-2026-102267 via pyjwt (1.4.2)

pyjwt PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.7.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =0.0.1, =0.9.0, =5.4.0, =0.8.0, =0.3.3, =0.4.0 Source cves:...

django-googleauth-ng (>=2.1.0, <=2.3.0) potentially affected by CVE-2026-102267 via pyjwt (0.4.1)

pyjwt PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-googleauth-ng =2.1.0, =2.3.0 Source cves: CVE-2026-102267 Source advisory: OSV:GHSA-9V7F-9G4P-FFGJ...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-102267 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-102267 Source advisory: OSV:GHSA-9V7F-9G4P-FFGJ...