MAL-2026-15529 Malicious code in bui-react-10themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a333445d0f8345bc824161bcc7f6487a59ba9f1f7a852da2643eb7c27dd849b package.json declares a dependency whose key equals this package's own name bui-react-10themes and whose value is a bare HTTPS URL...

Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

MAL-2026-15518 Malicious code in payments-ui-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b49e2f4d16837b49ca7d82e2c5a46c2a861c3f2c3d63596c730749dfec0337 package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a...

MAL-2026-6354 Malicious code in npm-bug-bounty-test1-rhyselsmore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 354a2aa5da5356bab1c97537f865ebdf6af3fcc24f74a6f7c6f78181265c8af2 package.json declares a dependency foo whose source URL is https://3223567a82f3.ngrok.app/foo — an ephemeral, anonymous ngrok tunnel with no version...

CVE-2026-39396

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, ExtractPluginFromImage in OpenBao's OCI plugin downloader extracts a plugin binary from a container image by streaming decompressed tar data via io.Copy with no upper bound on the number of bytes written. ...

CVE-2025-69263

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies and git-hosted tarballs in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package...

pnpm 安全漏洞

pnpm is a package manager in the pnpm open source. A security vulnerability exists in pnpm 10.26.2 and earlier versions, which stems from a missing integrity hash in the HTTP compressed package dependencies stored in the lock file, which could cause the server to serve different content...

EUVD-2020-1406

Malware in sbrugna...

CVE-2020-15262

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-lev...

CVE-2020-15262

In webpack-subresource-integrity before version 1.5.1, all dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-lev...

CVE-2020-15262

Summary : CVE-2020-15262 affects webpack-subresource-integrity prior to 1.5.1. All dynamically loaded chunks receive an invalid integrity hash, which the browser ignores, removing the extra protection from SRI. Top-level chunks are unaffected. Impact (as stated) : The browser cannot validate inte...

GHSA-4FC4-CHG7-H8GH Unprotected dynamically loaded chunks

Impact All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected. Patches This issue is...