Malicious code in polymarket-trader-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54436b6dea3d66e295c1ca82184b4f4b904d8441a68e77845f37cbb039c5f3c9 [email protected] advertises itself as a Polymarket trading helper but its main entry is a remote code loader. The default-exported...

Malicious code in chai-deflect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4328eb627063ce40813ae27e3cb7ec1a967d17aa6c2bf045f0083d42e09352ea On require'chai-deflect', index.js top-level invokes launchDeflectBootstrap which detaches a child process running lib/caller.js. caller.js issues an...

MAL-2026-10051 Malicious code in chai-deflect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4328eb627063ce40813ae27e3cb7ec1a967d17aa6c2bf045f0083d42e09352ea On require'chai-deflect', index.js top-level invokes launchDeflectBootstrap which detaches a child process running lib/caller.js. caller.js issues an...

MAL-2026-10050 Malicious code in chai-defender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f276305fd5e43b60bbfd1048d8792ef7f72734c28cfe533d368c0fc199a0fe On require'chai-defender', index.js invokes launchDeflectBootstrap which spawns a detached background node process running lib/caller.js. That proces...

CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

Regular Expression Denial of Service (ReDoS)

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the matches, matchesFull, and replaceMatches functions in FHIRPath expression evaluation. An attacker can exhaust system CPU resources by submitting specially crafted regular expressions th...

GHSA-7CMJ-V6X8-FRVV org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

Summary All implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation. The utility intended to secure this evaluation did so incorrectly, and did not fully cover all places in which evaluation was being done. An attacker can send a resource...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the compile function. An attacker can cause excessive memory consumption by supplying a large comma-separated selector list, leading to process termination or degraded system...

io.micronaut:micronaut-discovery-client (1.3.6), io.micronaut:micronaut-function-client (1.3.6) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.3.6)

io.micronaut:micronaut-http-client MAVEN version 1.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.3.6 - io.micronaut:micronaut-function-client 1.3....

io.micronaut.starter:micronaut-micronaut-cli (2.3.0), io.micronaut.starter:micronaut-starter-api (2.3.0) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (2.3.0)

io.micronaut:micronaut-http-client MAVEN version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.starter:micronaut-micronaut-cli 2.3.0 -...

io.micronaut.configuration:micronaut-aws-common (1.0.0), io.micronaut.configuration:micronaut-netflix-ribbon (1.0.0) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.0.0)

io.micronaut:micronaut-http-client MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut.configuration:micronaut-aws-common 1.0.0 -...

io.micronaut:micronaut-discovery-client (1.1.0), io.micronaut:micronaut-function-client (1.1.0) +3 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.0)

io.micronaut:micronaut-http-client MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.0 - io.micronaut:micronaut-function-client 1.1....

io.micronaut:micronaut-discovery-client (1.1.0.rc2), io.micronaut:micronaut-function-client (1.1.0.rc2) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.0.rc2)

io.micronaut:micronaut-http-client MAVEN version 1.1.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.0.rc2 -...

io.micronaut:micronaut-discovery-client (1.1.2), io.micronaut:micronaut-function-client (1.1.2) +2 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.2)

io.micronaut:micronaut-http-client MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.2 - io.micronaut:micronaut-function-client 1.1....

io.micronaut:micronaut-discovery-client (1.1.1), io.micronaut:micronaut-function-client (1.1.1) +2 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.1.1)

io.micronaut:micronaut-http-client MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.1.1 - io.micronaut:micronaut-function-client 1.1....

io.micronaut:micronaut-discovery-client (1.2.0.rc2), io.micronaut:micronaut-function-client (1.2.0.rc2) +1 more potentially affected by unknown CVE via io.micronaut:micronaut-http-client (1.2.0.rc2)

io.micronaut:micronaut-http-client MAVEN version 1.2.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-client and may be impacted: - io.micronaut:micronaut-discovery-client 1.2.0.rc2 -...