CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

CVE-2026-72716 Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...

CVE-2026-71866

Orval is a tool that generates type-safe TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions 8.19.0 through 8.21.0 are affected by an import-time remote code execution vulnerability caused by a double quote in a schema property name being emitted into the generated zod.obje...

CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

MAL-2026-14258 Malicious code in ranux-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23 The package main index.js is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded...

MAL-2026-14246 Malicious code in hardhat-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e The package's main entry index.js unconditionally requires./lib/config, which is a 4MB obfuscator.io-style blob string array of 23,981 entries with a...

Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...

MAL-2026-14223 Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...

MAL-2026-14209 Malicious code in sui-gql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33 On require, lib/telemetry.js runs a top-level IIFE that reads the installer's /.gitconfig, extracts the configured email addresses and user name,...

MAL-2026-14201 Malicious code in chaikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4 The package's main entry index.js unconditionally requires./lib/config, a 4MB obfuscator.io-style file RC4 string-array decoder with 23,902 entries,...

Malicious code in chaikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4711ba83393e8da11ab4368f9b38dac3de00bc523946cc27e4e47f38a51b9c4 The package's main entry index.js unconditionally requires./lib/config, a 4MB obfuscator.io-style file RC4 string-array decoder with 23,902 entries,...

Malicious code in tailwind-custom-templates (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720 The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an...

PT-2026-78548

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A double quote in a header parameter name is emitted into the generated request-validation...

MAL-2026-13847 Malicious code in @years18/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3cd688f6f3a7075db2ae860db719600fda1fdd23485262a9f72de758834a582 The package presents itself as an n8n community node but ships a hostile payload in both callback.js invoked from scripts.postinstall and index.js...

Malicious code in chai-as-format (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c The package's index.js unconditionally requires./lib/config, which is a 4MB single-line file consisting of an obfuscator.io-style hex-encoded string...

MAL-2026-13700 Malicious code in chai-as-deployer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...