Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

MAL-2026-17250 Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

MAL-2026-17281 Malicious code in @hrmony/valuenet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6f054c1d690a418a5d18f7d88883085468cc0bdfab8c604e69a82633d2de72 On require/import, the main module of @hrmony/valuenet auto-executes and POSTs installer-side secrets to the hardcoded attacker endpoint...

Malicious code in @hrmony/valuenet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6f054c1d690a418a5d18f7d88883085468cc0bdfab8c604e69a82633d2de72 On require/import, the main module of @hrmony/valuenet auto-executes and POSTs installer-side secrets to the hardcoded attacker endpoint...

MAL-2026-17277 Malicious code in @hrmony/pladddform-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...

MAL-2026-17276 Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

MAL-2026-17261 Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...

Important: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.30.2 Release.

Red Hat OpenShift Dev Spaces 3.30.2 has been released. The 3.30.2 release fixes the regression CRW-13015 Get Started / sample cards on the dashboard are empty after upgrade to 3.30. This release provides additional CVE fixes and container dependency updates to Dev Spaces 3.30. Red Hat OpenShift D...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +558 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =0.0.2, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =2.22.0 and more Source cves: CVE-2026-97688 Source advisory: SNYK:PYTHON-URLLIB3-20302845...

@aicolab/room-service (>=2.0.2, <=2.1.0), @anchrd/intel (>=0.59.0, <=0.125.0) +35 more potentially affected by CVE-2026-102521 via lib0 (>=1.0.0-rc.1, <=1.0.0-rc.32)

lib0 NPM version =1.0.0-rc.1, =2.0.2, =0.59.0, =0.1.0, =0.52.0, =0.0.1-beta.1, =0.52.0, =0.54.0, =0.52.0, =0.54.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.52.0, =0.55.0 and more Source cves: CVE-2026-102521 Source advisory: MEND:CVE-2026-102521...

@appsoftwareltd/etherpk-mcp (>=0.8.1, <=0.14.0), @bytestream-tv/coop (0.1.0) +61 more potentially affected by CVE-2026-102521 via lib0 (>=0.0.6, <=0.2.117)

lib0 NPM version =0.0.6, =0.8.1, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763,...

@appsoftwareltd/etherpk-mcp (>=0.8.1, <=0.14.0), @bytestream-tv/coop (0.1.0) +62 more potentially affected by CVE-2026-102360 via lib0 (>=0.0.4, <=0.2.117)

lib0 NPM version =0.0.4, =0.8.1, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.0.0-alpha.1826142686, =3.2.7-alpha.6226622763,...

airflow-oracle-snowflake-plugin (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-81930 via apache-airflow-providers-snowflake (3.3.0)

apache-airflow-providers-snowflake PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-snowflake and may be impacted: - airflow-oracle-snowflake-plugin =0.1.0, =0.1.2 Source cves: CVE-2026-81930 Source advisory:...

ROOT-APP-NPM-GHSA-GV7W-RQVM-QJHR GHSA-gv7w-rqvm-qjhr in esbuild - Patched by Root

Root has patched GHSA-gv7w-rqvm-qjhr in the esbuild package for Root:npm. Multiple fixed versions available...

@3ngram/server (>=1.2.6, <=1.8.4), @aaarc/recursivelearnmcp (>=0.1.0, <=0.1.3) +596 more potentially affected by unknown CVE via hono (>=4.12.4, <=4.13.10)

hono NPM version =4.12.4, =1.2.6, =0.1.0, =0.3.1, =0.4.3, =0.0.138, =0.0.138, =0.0.138, =0.0.138, =0.0.148, =0.0.138, =0.0.0-pr-306-20260707164534, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.70 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0113...

03-gs-ee-6 (0.3.5), @adhd/workspace-codegen-nx (>=0.1.3, <=0.1.5) +3133 more potentially affected by CVE-2026-102278 via brace-expansion (>=4.0.0, <=5.0.9)

brace-expansion NPM version =4.0.0, =0.1.3, =0.0.1-alpha.5, =0.0.4, =1.1.7, =1.1.8 - @angranit/fantom-virma 0.1.0 - @angranit/first-step-to-get-tea 0.1.0 - @angranit/hapeipons 1.1.2 - @angranit/nearly-vm 0.1.0 - @angranit/newme-project 0.1.0 - @angranit/npmjs-for-tea-project 0.1.0 and more Source...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-102276 via brace-expansion (>=1.1.0, <=1.1.16)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-102276 Source advisory: SNYK:JS-BRACEEXPANSION-20244952...

0.extends.fc (1.0.65), 0.extends.react (1.0.51) +10353 more potentially affected by CVE-2026-100701 via nodemailer (>=5.0.0, <=10.0.1)

nodemailer NPM version =5.0.0, =1.0.49, =1.0.1, =1.0.0, =1.0.0, =0.2.9, =0.2.19 and more Source cves: CVE-2026-100701 Source advisory: OSV:GHSA-6VJ9-MWQ6-2F5V...