MAL-2026-1434 Malicious code in my-super-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 58a8ef40f042f56d80d455abeb03442516dfd8ed81f462d9da071089ff82f31e During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

Malicious code in ariadne-federation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3eb5492b220fedd5fedb29045328e749d659aea6e38ed743f7aace2d623d07d2 During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

MAL-2026-1431 Malicious code in ariadne-federation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3eb5492b220fedd5fedb29045328e749d659aea6e38ed743f7aace2d623d07d2 During import, package decrypts and runs a malicious executable. The executable is hidden in an encoded and xored form in the JSON resource file. This is a...

multi-clasp2 (4.0.0) potentially affected by CVE-2026-4092 via @google/clasp (3.1.3)

@google/clasp NPM version 3.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @google/clasp and may be impacted: - multi-clasp2 4.0.0 Source cves: CVE-2026-4092 Source advisory: OSV:GHSA-HQJG-PWW4-PCGQ...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +41 more potentially affected by CVE-2026-32635 via @angular/core (>=19.0.0, <=19.2.19)

@angular/core NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-32635 Source advisory:...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.192-alpha) +14 more potentially affected by CVE-2026-32635 via @angular/compiler (>=21.0.0, <=21.2.1)

@angular/compiler NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =1.0.0, =4.4.0-beta.2, =1.0.77-rc.1, =0.0.1, =0.2.0, =0.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-32635 Source advisory: SNYK:JS-ANGULARCOMPILER-15610286...

@advancedco/design-system-workspace (4.0.0), @agdo/object-model (>=1.0.1, <=1.2.34) +1016 more potentially affected by CVE-2026-32635 via @angular/core (>=17.0.0-next.3, <=18.2.14)

@angular/core NPM version =17.0.0-next.3, =1.0.1, =1.0.2, =0.0.0, =1.0.0, =1.0.0, =0.0.1, =0.2.2, =1.0.0, =0.0.55, =0.0.1, =1.0.0, =1.0.1 and more Source cves: CVE-2026-32635 Source advisory: OSV:GHSA-G93W-MFHG-P222...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.192-alpha) +42 more potentially affected by CVE-2026-32635 via @angular/core (>=21.0.0, <=21.2.1)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =4.0.0, =5.38.0, =4.0.0, =5.15.0, =6.1.0-edge.2 and more Source cves: CVE-2026-32635 Source advisory: OSV:GHSA-G93W-MFHG-P222...

@amwaljs/checkout-angular (0.2.11), @bitblit/ngx-acute-common (>=6.1.182-alpha, <=6.1.192-alpha) +42 more potentially affected by CVE-2026-32635 via @angular/core (>=21.0.0, <=21.2.1)

@angular/core NPM version =21.0.0, =6.1.182-alpha, =6.1.182-alpha, =0.1.0-beta.54, =0.1.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =3.0.1, =2.0.1, =2.0.1, =2.0.1, =4.0.0, =5.38.0, =4.0.0, =5.15.0, =6.1.0-edge.2 and more Source cves: CVE-2026-32635 Source advisory: SNYK:JS-ANGULARCORE-15610287...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +42 more potentially affected by CVE-2026-32635 via @angular/compiler (>=19.0.0, <=19.2.19)

@angular/compiler NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-32635 Source advisory:...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +28 more potentially affected by CVE-2026-32635 via @angular/compiler (>=20.0.0, <=20.3.17)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =0.13.0 and more Source cves: CVE-2026-32635 Source advisory: SNYK:JS-ANGULARCOMPILER-15610286...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +42 more potentially affected by CVE-2026-32635 via @angular/compiler (>=19.0.0, <=19.2.19)

@angular/compiler NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-32635 Source advisory:...

@absolutejs/absolute (0.12.4), @bitblit/ngx-acute-common (>=5.1.121, <=6.1.180-alpha) +28 more potentially affected by CVE-2026-32635 via @angular/compiler (>=20.0.0, <=20.3.17)

@angular/compiler NPM version =20.0.0, =5.1.121, =5.1.121, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =8.9.1, =0.0.57, =0.7.2, =0.10.1, =0.8.0, =0.13.0 and more Source cves: CVE-2026-32635 Source advisory: OSV:GHSA-G93W-MFHG-P222...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +37 more potentially affected by CVE-2026-32635 via @angular/core (>=20.0.0, <=20.3.17)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =9.0.0 and more Source cves: CVE-2026-32635 Source advisory: OSV:GHSA-G93W-MFHG-P222...

@ammar_sk/shared-lib (0.0.4), @angulartoolsdr/control-material (>=20.0.3, <=20.2.4) +37 more potentially affected by CVE-2026-32635 via @angular/core (>=20.0.0, <=20.3.17)

@angular/core NPM version =20.0.0, =20.0.3, =20.0.6, =20.0.6, =5.1.121, =5.1.121, =261.20.7, =261.1.1, =261.1.5, =261.20.1, =19.2.2-snapshot-1746816578592, =19.2.2-snapshot-1746816578592, =8.9.1, =9.0.0 and more Source cves: CVE-2026-32635 Source advisory: SNYK:JS-ANGULARCORE-15610287...

4byte-peru-components (1.0.0), @aipeel/mat-currency-field (>=3.19.0, <=3.19.1) +41 more potentially affected by CVE-2026-32635 via @angular/core (>=19.0.0, <=19.2.19)

@angular/core NPM version =19.0.0, =3.19.0, =19.0.0, =3.0.0, =5.0.559-alpha, =5.0.559-alpha, =2.2.2-beta-1, =1.0.5, =1.28.26-alpha.1, =19.0.0-next.1, =19.0.0-next.1, =0.0.0-beta-20260114160010, =0.0.1-canary.0.0, =1.0.0-canary.1 and more Source cves: CVE-2026-32635 Source advisory:...

4591-libs (>=0.0.1, <=0.2.0), @0x666c6f/morpho-onchain-data-model (>=1.0.0, <=1.0.5) +4144 more potentially affected by CVE-2026-32630 via file-type (>=20.0.0, <=21.3.1)

file-type NPM version =20.0.0, =0.0.1, =1.0.0, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0-rc.2 and more Source cves: CVE-2026-32630 Source advisory: OSV:GHSA-J47W-4G3G-C36V...

4591-libs (>=0.0.1, <=0.2.0), @0x666c6f/morpho-onchain-data-model (>=1.0.0, <=1.0.5) +4144 more potentially affected by CVE-2026-32630 via file-type (>=20.0.0, <=21.3.1)

file-type NPM version =20.0.0, =0.0.1, =1.0.0, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =1.0.0-rc.2 and more Source cves: CVE-2026-32630 Source advisory: SNYK:JS-FILETYPE-15609896...

org.webjars.npm:archive-type (4.0.0), org.webjars.npm:decompress-tar (4.1.1) +2 more potentially affected by CVE-2026-32630 via org.webjars.npm:file-type (>=3.9.0, <=5.2.0)

org.webjars.npm:file-type MAVEN version =3.9.0, =5.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:file-type and may be impacted: - org.webjars.npm:archive-type 4.0.0 - org.webjars.npm:decompress-tar 4.1.1 -...

Unsafe Dependency Resolution

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the automatic plugin discovery in .openclaw/extensions/. An attacker can execute arbitrary code by including a malicious plugin in a cloned repository,...