EUVD-2026-104412

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

Malware in alb-um-availa-ble-zip-mp3-file-someone-to-drive-you-home-vbwzp-koufrz

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cab30295e4c047eb1dd313b68001538fdd727e2bd49f3aac87fe67d10e9236b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alb-um-availa-ble-zip-mp3-file-470287-watch-my-moves-2zscf-aatbzj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc4c7c4064762128656fff603f846e8eca4e3458cb6bae2bee941f7f63b816af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in mp3-do-wnload-file-to-day-27091-usa-united-state-of-atlanta-xoisl-pqpsio

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17954 Malicious code in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff887d27322671592352c1e6755c4c39bc7be6f1bbb2148dc69ce2d3018a63e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in a-vailable-al-bum-file-101379-communion-mt1lk-dvshll

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in a-lbum-do-wnload-avai-lable-file-11522-seven-and-the-ragged-tiger-bkmqg-xorids

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in a-lbum-do-wnload-avai-lable-file-playing-the-angel-l9tng-nkbcwn

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvp

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in a-vailable-al-bum-file-36850-other-peoples-lives-vys1z-fuucqk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18023 Malicious code in mp3-do-wnload-file-to-day-27091-usa-united-state-of-atlanta-xoisl-pqpsio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87c9d9e58745706fee426791a737ac7812546f610fffa36157578214e4e878ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17953 Malicious code in a-lbum-do-wnload-avai-lable-file-10635-about-to-choke-pzt0k-onnsvp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fea9dc3511b8a42a624a4257e69fc68933bef239240dc0af0d030f3dc72421b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17968 Malicious code in alb-um-availa-ble-zip-mp3-file-470287-watch-my-moves-2zscf-aatbzj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc4c7c4064762128656fff603f846e8eca4e3458cb6bae2bee941f7f63b816af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18012 Malicious code in file-alb-um-zip-new-mp3-32338-think-before-you-speak-9znpc-akvcbt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07720e778ecc1d65f64bd2688bc36c70006971f7d8ec6362fd76ea8988acbb8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17959 Malicious code in a-vailable-al-bum-file-101379-communion-mt1lk-dvshll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db1398121380a70266af797842060413f11382cdcae697045a6510b6e393c2e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18024 Malicious code in mp3-do-wnload-file-to-day-d-nu951-cjkdsy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26a72bd5e4d4d678ec021807c8590abdecbe43a46702c59d46d8282298556226 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18025 Malicious code in mp3-file-zip-d-ownload-10759-grand-prix-ojzwj-auchhw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5beee8e9bda1a76ad80a7a3a5a97cd6828a7ff7d70a4dcb6165b849392e89215 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18029 Malicious code in mp3-file-zip-d-ownload-hypnotize-kpkk0-ygzaqq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cab30295e4c047eb1dd313b68001538fdd727e2bd49f3aac87fe67d10e9236b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mp3-do-wnload-file-to-day-d-nu951-cjkdsy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26a72bd5e4d4d678ec021807c8590abdecbe43a46702c59d46d8282298556226 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...