@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +167 more potentially affected by CVE-2026-44645 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.0.1-alpha.2, =0.0.1-alpha.0, =0.8.0, =0.31.16 - @altipla/directus-sdk-utils 0.7.2 and more Source cves: CVE-2026-44645 Source advisory: OSV:GHSA-8XX9-69P8-7JP3...

20190403-utils (1.0.0), 433bf (0.0.1) +7972 more potentially affected by CVE-2026-42089 via yeoman-environment (>=2.9.5, <=6.0.0)

yeoman-environment NPM version =2.9.5, =0.0.0, =0.1.0, =1.0.1-alpha.0, =2.0.0-beta.2, =1.18.0, =4.2.0, =6.0.0, =1.0.0, =1.0.0, =0.0.0, =0.2.46, =0.24.0 and more Source cves: CVE-2026-42089 Source advisory: SNYK:JS-YEOMANENVIRONMENT-17753983...

@edoday/react-sdk (>=1.2.0, <=1.2.1), weavedb-client (>=0.45.0, <=0.45.4) +4 more potentially affected by unknown CVE via weavedb-base (0.45.4)

weavedb-base NPM version 0.45.4 is affected by a known vulnerability. The following packages have a transitive dependency on weavedb-base and may be impacted: - @edoday/react-sdk =1.2.0, =0.45.0, =0.45.0, =0.45.0, =0.45.0, =0.45.1, =0.45.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-47...

Packagist Supply Chain Attack Infects 8 Packages Using GitHub-Hosted Linux Malware

A new "coordinated" supply chain attack campaign has impacted eight packages on Packagist including malicious code designed to run a Linux binary retrieved from a GitHub Releases URL. "Although the affected packages were all Composer packages, the malicious code was not added to composer.json,"...

@alexaegis/svelte-config (>=0.15.0, <=0.15.1), @builders-of-stuff/svelte-sui-wallet-adapter (>=1.2.0, <=2.1.0) +7 more potentially affected by CVE-2026-82258 via @sveltejs/kit (>=2.39.1, <=2.59.1)

@sveltejs/kit NPM version =2.39.1, =0.15.0, =1.2.0, =0.0.137, =0.1.0, =2.0.0, =5.0.0-alpha.1, =0.0.3-next.8, =0.3.2, =1.7.0, =1.15.1 Source cves: CVE-2026-82258 Source advisory: OSV:GHSA-HGV7-V322-MMGR...

libcrux-digest (>=0.0.4-pre.1, <=0.0.8), libcrux-kem (>=0.0.2-alpha.1, <=0.0.2) +10 more potentially affected by unknown CVE via libcrux-sha3 (>=0.0.2, <=0.0.9-rc.1)

libcrux-sha3 CARGO version =0.0.2, =0.0.4-pre.1, =0.0.2-alpha.1, =0.0.3, =0.0.2-alpha.1, =1.20.4, =0.2.0, =0.4.3, =0.8.0 - wpa-next 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0208...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @142vip/fairy-cli (>=0.0.3-alpha.19, <=0.0.3-alpha.28) +64 more potentially affected by CVE-2026-45772 via turbo (>=1.3.1, <=2.9.12)

turbo NPM version =1.3.1, =4.2.1, =0.0.3-alpha.19, =1.0.0, =1.6.0, =0.3.0, =0.0.1, =0.1.0, =2.0.5, =0.1.0, =0.1.0, =0.4.0, =1.0.0, =1.0.1 and more Source cves: CVE-2026-45772 Source advisory: OSV:GHSA-3QCW-2RHX-2726...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1022 more potentially affected by CVE-2026-45740 via protobufjs (>=8.0.0, <=8.0.3)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.6.0, =0.8.0 and more Source cves: CVE-2026-45740 Source advisory: OSV:GHSA-JGGG-4JG4-V7C6...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +53 more potentially affected by CVE-2026-45669 via nuxt (>=3.4.3, <=3.20.1)

nuxt NPM version =3.4.3, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.12.0-rc.7 and more Source cves: CVE-2026-45669 Source advisory: OSV:GHSA-FX6J-W5W5-H468...

The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave

Multi-ecosystem supply chain compromise by TeamPCP targets GitHub, NPM, and VSCode to steal credentials and establish persistence...

Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account

Cybersecurity researchers have discovered a fresh software supply chain attack campaign that has compromised various npm packages associated with the @antv ecosystem as part of the ongoing Mini Shai-Hulud attack wave. "The attack affects packages tied to the npm maintainer account atool, includin...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...