lean4monaco (>=1.1.0, <=1.1.7) potentially affected by CVE-2026-32732 via @leanprover/unicode-input-component (0.1.9)

@leanprover/unicode-input-component NPM version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on @leanprover/unicode-input-component and may be impacted: - lean4monaco =1.1.0, =1.1.7 Source cves: CVE-2026-32732 Source advisory:...

@studiocms/migrator (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-32638 via studiocms (>=0.2.0, <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32638 Source advisory: OSV:GHSA-XVF4-CH4Q-2M24...

@withstudiocms/api-spec (>=0.3.0, <=0.3.1), @withstudiocms/effect (0.4.0) +1 more potentially affected by CVE-2026-32638 via effectify (0.1.1)

effectify NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on effectify and may be impacted: - @withstudiocms/api-spec =0.3.0, =0.4.0, =0.4.3 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-EFFECTIFY-15682413...

@studiocms/migrator (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-32638 via studiocms (>=0.2.0, <=0.3.0)

studiocms NPM version =0.2.0, =0.2.0, =0.2.1 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-STUDIOCMS-15682412...

@studiocms/migrator (>=0.1.0-beta.1, <=0.2.1), @withstudiocms/auth-kit (>=0.1.0-beta.1, <=0.1.3) +2 more potentially affected by CVE-2026-32638 via @withstudiocms/effect (>=0.1.0, <=0.3.0)

@withstudiocms/effect NPM version =0.1.0, =0.1.0-beta.1, =0.1.0-beta.1, =0.1.0-beta.1, =0.1.0-beta.25, =0.3.0 Source cves: CVE-2026-32638 Source advisory: SNYK:JS-WITHSTUDIOCMSEFFECT-15682415...

dicebear (>=9.0.0, <=9.3.2) potentially affected by CVE-2026-29112 via @dicebear/converter (>=9.0.0, <=9.3.2)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.3.2 Source cves: CVE-2026-29112 Source advisory: SNYK:JS-DICEBEARCONVERTER-15682416...

dicebear (>=9.0.0, <=9.3.2) potentially affected by CVE-2026-29112 via @dicebear/converter (>=9.0.0, <=9.3.2)

@dicebear/converter NPM version =9.0.0, =9.0.0, =9.3.2 Source cves: CVE-2026-29112 Source advisory: OSV:GHSA-V3R3-4QGC-VW66...

cy-ai-trainer (>=0.0.1, <=0.0.2), llama-index-packs-vanna (>=0.0.1, <=0.3.0) +2 more potentially affected by CVE-2026-4229 via vanna (>=0.0.30, <=2.0.2)

vanna PYPI version =0.0.30, =0.0.1, =0.0.1, =1.4.0a20260123, =1.0.0, =2.0.0 Source cves: CVE-2026-4229 Source advisory: SNYK:PYTHON-VANNA-15674521...

cy-ai-trainer (>=0.0.1, <=0.0.2), llama-index-packs-vanna (>=0.0.1, <=0.3.0) +2 more potentially affected by CVE-2026-4231 via vanna (>=0.0.30, <=2.0.2)

vanna PYPI version =0.0.30, =0.0.1, =0.0.1, =1.4.0a20260123, =1.0.0, =2.0.0 Source cves: CVE-2026-4231 Source advisory: SNYK:PYTHON-VANNA-15674520...

cy-ai-trainer (>=0.0.1, <=0.0.2), llama-index-packs-vanna (>=0.0.1, <=0.3.0) +2 more potentially affected by CVE-2026-4230 via vanna (>=0.0.30, <=2.0.2)

vanna PYPI version =0.0.30, =0.0.1, =0.0.1, =1.4.0a20260123, =1.0.0, =2.0.0 Source cves: CVE-2026-4230 Source advisory: SNYK:PYTHON-VANNA-15674519...

MAL-2026-1525 Malicious code in peer-deps-external (npm)

The package 'peer-deps-external' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-3125 Malicious code in transform-regexp-constructors (npm)

The package 'transform-regexp-constructors' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

OESA-2026-1563 libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...

Malicious code in kvstore-pb2-grpc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7208dedf651be9d1e330692ef042b89e5bcae7e8aeee7f2ab400d49e7a574de8 During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

MAL-2026-1433 Malicious code in kvstore-pb2-grpc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7208dedf651be9d1e330692ef042b89e5bcae7e8aeee7f2ab400d49e7a574de8 During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

MAL-2026-1432 Malicious code in dgl-cu117 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4f9fcfe9f469df3c132eca5b08bac4a30c146c7b1305f506fd900b1e78581b0d During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

Malicious code in dgl-cu117 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4f9fcfe9f469df3c132eca5b08bac4a30c146c7b1305f506fd900b1e78581b0d During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

Malicious code in python-anchor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 914b16cbc506c57a77eeed5ae14955bcf3b58fa49da92c2686b56a1d531c5268 During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

MAL-2026-1435 Malicious code in python-anchor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 914b16cbc506c57a77eeed5ae14955bcf3b58fa49da92c2686b56a1d531c5268 During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

Malicious code in my-super-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 58a8ef40f042f56d80d455abeb03442516dfd8ed81f462d9da071089ff82f31e During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...