@holocronlab/botruntime-adk (>=2.0.10, <=2.9.7), @holocronlab/brt (>=0.5.8, <=0.12.3) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.9.7)

@holocronlab/botruntime-runtime NPM version 2.9.7 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk =2.0.10, =0.5.8, =0.12.3 Source cves: unknown CVE Source advisory:...

MAL-2026-13419 Malicious code in @holocronlab/botruntime-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad15bd6ba410e0c0ca88ac22f1632a4b6707c4c66396c49c0ba90f906b19ae33 The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported client as 'the authenticated...