Malicious code in @oku-ui/slot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00107e442d452bcb43403d89ade38e4fb111f1d1624b2dc4d2498df1f9a6ca2 The package @oku-ui/slot was found to contain malicious code. Source: ghsa-malware 2a90589b3706323fe3b284df0f3935425b573427c0e51600a8c59a2fc69a670d A...

Malicious code in automation_model (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1926379efdd9fddb153965f44070e510b81ea958a611dc7b2fafb891b856f35c The package automationmodel was found to contain malicious code. Source: ghsa-malware b6b4ab86b995aa30207899784d17feba68bd397866ebb733d0de222eeb2a4c1...

Malicious code in flatten-unflatten (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96678bbed20be5d500dc65bda769b41f7d3666a18c8a76262aca5ed79ef584fd The package flatten-unflatten was found to contain malicious code. Source: ghsa-malware...

Malicious code in medusa-plugin-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7af11d8b0e347690c78b45c790ef5d54f7cadf6d5d2fa89a86ef6c1765ab136f The package medusa-plugin-logs was found to contain malicious code. Source: ghsa-malware...

Malicious code in lang-codes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7644eb22af82aaf1aeebcd8954139ce3dc9b43a0db43be02605ee10037e3f75 The package lang-codes was found to contain malicious code. Source: ghsa-malware 80738e6b29d50856453735fa6d92a27222eb3def027ae81195eb7555e076f7df Any...

Malicious code in lint-staged-imagemin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8cfbe33b97d4e3997d348c9532c834715e755ea1d28a6b30f2276209d4f45db The package lint-staged-imagemin was found to contain malicious code. Source: ghsa-malware...

Malicious code in @asyncapi/python-paho-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b7e91afb25619c373d083857f06f65945216536aa6308326de63dd33458f72c The package @asyncapi/python-paho-template was found to contain malicious code. Source: ghsa-malware...

Malicious code in @kvytech/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e27717d96aa14c260a48ca84c38f3f08f6b3352f82cd27b83ac56547c46cc6 The package @kvytech/components was found to contain malicious code. Source: ghsa-malware...

Malicious code in @ensdomains/reverse-records (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e16814335619e8655b02ca0583e019d232eb4f008db3e99d25f3ad1eb3d18c The package @ensdomains/reverse-records was found to contain malicious code. Source: ghsa-malware...

Malicious code in @posthog/rrweb-snapshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e09f740a4b99a55a685452aa412d77942e67c0de95136282343012196ed7bf41 The package @posthog/rrweb-snapshot was found to contain malicious code. Source: ghsa-malware...

Malicious code in @posthog/rrweb-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de65400909e7dab680997106feffcc22e5a954f60fe775e82db28e5529bacb0c The package @posthog/rrweb-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in @postman/aether-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf4244dc3aeb4aeef61e6a25bf53dd406e67c8b3d33f710a91934f64a631ae69 The package @postman/aether-icons was found to contain malicious code. Source: ghsa-malware...

Malicious code in @posthog/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57662af8290901771cf534d8b1ca05ca88dfd84054580144d934f730549a4653 The package @posthog/cli was found to contain malicious code. Source: ghsa-malware e663c40b9060088ff86ea24eec083b9b5bf8afdec2e1963895e47e5177a673d1 A...

USN-7885-1: OpenJDK 21 vulnerabilities

Jinfeng Guo discovered that the Security component of OpenJDK 21 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. CVE-2025-53057 Darius Bohni discovered that the JAX...

USN-7884-1 openjdk-25 vulnerabilities

Jinfeng Guo discovered that the Security component of OpenJDK 25 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. CVE-2025-53057 Darius Bohni discovered that the JAX...

USN-7884-1: OpenJDK 25 vulnerabilities

Jinfeng Guo discovered that the Security component of OpenJDK 25 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. CVE-2025-53057 Darius Bohni discovered that the JAX...

Malicious code in @asyncapi/specs (npm)

@asyncapi/specs versions 6.11.2-alpha.1 and 6.11.2 were published as part of the "Miasma RAT" software supply-chain attack campaign identifier "miasma-train-p1" that compromised several widely used @asyncapi npm packages on 2026-07-14. Unlike the whitespace-hiding technique used in the compromise...

Malicious code in tailwind-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9713ae723aefcab52d65da5c1473fffe7835c37849c133d7cecffa7ba7284e66 The package tailwind-inquirer was found to contain malicious code. Source: ghsa-malware...

XML External Entity (XXE)

langchaintextsplitters is vulnerable to XML External Entity XXE injection. The vulnerability is due to unsafe parsing of arbitrary XSLT stylesheets using lxml without access controls, which allows an attacker to read local files or fetch external resources accessible to the LangChain process...

USN-7883-1: OpenJDK 17 vulnerabilities

Jinfeng Guo discovered that the Security component of OpenJDK 17 did not correctly handle certain representations of encoded strings. An unauthenticated remote attacker could possibly use this issue to modify files or leak sensitive information. CVE-2025-53057 Darius Bohni discovered that the JAX...