@aaquib/whatsasenanpm (1.3.5), @alexandersen01/sharepoint-mcp-server-better (0.3.23) +81 more potentially affected by CVE-2026-26832 via node-tesseract-ocr (2.2.1)

node-tesseract-ocr NPM version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on node-tesseract-ocr and may be impacted: - @aaquib/whatsasenanpm 1.3.5 - @alexandersen01/sharepoint-mcp-server-better 0.3.23 - @artdotstyle/filepix =1.0.10, =0.0.1,...

@datagica/read-document (0.1.0), dialog-formatter (>=0.2.0, <=0.2.2) potentially affected by CVE-2026-26831 via textract (>=2.1.1, <=2.4.0)

textract NPM version =2.1.1, =0.2.0, =0.2.2 Source cves: CVE-2026-26831 Source advisory: OSV:GHSA-9PCJ-M5RR-P28G...

allbot (>=0.1.1, <=0.1.70), multi-rest (>=1.3.0-1, <=1.4.5) potentially affected by CVE-2026-26833 via thumbler (1.1.2)

thumbler NPM version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on thumbler and may be impacted: - allbot =0.1.1, =1.3.0-1, =1.4.5 Source cves: CVE-2026-26833 Source advisory: OSV:GHSA-MVHF-547C-H55R...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +123 more potentially affected by CVE-2026-33287 via liquidjs (>=10.2.0, <=10.22.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =12.0.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =0.9.33, =1.0.0, =1.0.0, =1.0.11 - @deconz-community/directus-extension-ddf-store 0.1.0 and more Source cves: CVE-2026-33287 Source advisory: OSV:GHSA-6Q5M-63H6-5X4V...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +146 more potentially affected by CVE-2026-33287 via liquidjs (>=10.2.0, <=10.25.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =12.0.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =0.9.33, =1.0.0, =1.0.10 and more Source cves: CVE-2026-33287 Source advisory: SNYK:JS-LIQUIDJS-15767938...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +123 more potentially affected by CVE-2026-33285 via liquidjs (>=10.2.0, <=10.22.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =12.0.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =0.9.33, =1.0.0, =1.0.0, =1.0.11 - @deconz-community/directus-extension-ddf-store 0.1.0 and more Source cves: CVE-2026-33285 Source advisory: OSV:GHSA-9R5M-9576-7F6X...

@grackle-ai/cli (>=0.0.2, <=0.70.5) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.5)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.5 Source cves: unknown CVE Source advisory: OSV:GHSA-8G29-8XWR-QMHR...

@grackle-ai/cli (>=0.0.2, <=0.70.5) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.5)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.5 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAISERVER-15840331...

@grackle-ai/cli (>=0.0.2, <=0.70.4) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.4)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.4 Source cves: unknown CVE Source advisory: OSV:GHSA-5J35-XR4G-VWF4...

@grackle-ai/cli (>=0.0.2, <=0.70.4) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.4)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.4 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAISERVER-15840037...

@grackle-ai/cli (>=0.0.2, <=0.70.3) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.3)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.3 Source cves: unknown CVE Source advisory: OSV:GHSA-3MJM-X6GW-2X42...

@grackle-ai/cli (>=0.0.2, <=0.70.4) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.4)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.4 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAISERVER-15840038...

@grackle-ai/cli (>=0.37.0, <=0.70.0), @grackle-ai/server (>=0.37.0, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.70.0)

@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.70.0 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIPOWERLINE-15871386...

@grackle-ai/cli (>=0.37.0, <=0.70.0), @grackle-ai/server (>=0.37.0, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/powerline (>=0.37.0, <=0.70.0)

@grackle-ai/powerline NPM version =0.37.0, =0.37.0, =0.37.0, =0.70.0 Source cves: unknown CVE Source advisory: OSV:GHSA-XQ7H-VWJP-5VRH...

@grackle-ai/cli (>=0.0.2, <=0.70.2) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.2)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.2 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAISERVER-15840352...

@grackle-ai/cli (>=0.0.2, <=0.70.2) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.2)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.2 Source cves: unknown CVE Source advisory: OSV:GHSA-W3HV-X4FP-6H6J...

@grackle-ai/cli (>=0.19.0, <=0.70.1), @grackle-ai/server (>=0.19.0, <=0.70.1) potentially affected by unknown CVE via @grackle-ai/mcp (>=0.19.0, <=0.70.1)

@grackle-ai/mcp NPM version =0.19.0, =0.19.0, =0.19.0, =0.70.1 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIMCP-15874101...

@grackle-ai/cli (>=0.19.0, <=0.70.1), @grackle-ai/server (>=0.19.0, <=0.70.1) potentially affected by unknown CVE via @grackle-ai/mcp (>=0.19.0, <=0.70.1)

@grackle-ai/mcp NPM version =0.19.0, =0.19.0, =0.19.0, =0.70.1 Source cves: unknown CVE Source advisory: OSV:GHSA-647H-P824-99W7...

@grackle-ai/cli (>=0.0.2, <=0.70.0) potentially affected by unknown CVE via @grackle-ai/server (>=0.0.2, <=0.70.0)

@grackle-ai/server NPM version =0.0.2, =0.0.2, =0.70.0 Source cves: unknown CVE Source advisory: OSV:GHSA-7Q9X-8G6P-3X75...

Two LiteLLM versions published containing credential harvesting malware

After an API Token exposure from an exploited trivy dependency, two new releases of litellm were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. Anyone who has installed and run the project should assume an...