​​Supply Chain Compromise Impacts Axios Node Package Manager​

The Cybersecurity and Infrastructure Security Agency CISA is releasing this alert to provide guidance in response to the software supply chain compromise of the Axios node package manager npm.1 Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments...

CVE-2026-6621

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument proto causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The...

PT-2026-35486

Root has patched SNYK-JS-AXIOS-6124857 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

PT-2026-35487

Root has patched SNYK-JS-AXIOS-6144788 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

PT-2026-35488

Root has patched SNYK-JS-AXIOS-9403194 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

Malicious code in pil2-stark-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d38245d3114b579956426c150e00f8821821c418e0d87077788d0180ed19a054 The package pil2-stark-js was found to contain malicious code...

MAL-2026-2793 Malicious code in pil2-stark-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d38245d3114b579956426c150e00f8821821c418e0d87077788d0180ed19a054 The package pil2-stark-js was found to contain malicious code...

Malicious code in pil2-proofman-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec44a98d8fd4dfdf91d31b7990ec8005ee4d4aab1d6030d18e86f84758659093 The package pil2-proofman-js was found to contain malicious code...

MAL-2026-2792 Malicious code in pil2-proofman-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec44a98d8fd4dfdf91d31b7990ec8005ee4d4aab1d6030d18e86f84758659093 The package pil2-proofman-js was found to contain malicious code...

Node.js: Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames

Vulnerability description not provided...

Malicious code in pretty-logger-js (npm)

pretty-logger-js is a malicious npm package that when imported downloads and executes a C2 dropper from https://www.jsonkeeper.com/b/OTOAQ. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e46da449e6d21efcef5e9975a2f8e90c31369882800ed4c560ae47ade99b53 The packa...

MAL-2026-2908 Malicious code in pretty-logger-js (npm)

pretty-logger-js is a malicious npm package that when imported downloads and executes a C2 dropper from https://www.jsonkeeper.com/b/OTOAQ. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e46da449e6d21efcef5e9975a2f8e90c31369882800ed4c560ae47ade99b53 The packa...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2163 more potentially affected by CVE-2026-41240 via dompurify (>=3.0.0, <=3.3.3)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.3 and more Source cves: CVE-2026-41240 Source advisory: SNYK:JS-DOMPURIFY-16078387...

RockyLinux 8 : nodejs:20 (RLSA-2026:8339)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:8339 advisory. minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-26996 minimatch: Minimatch: Denial of Service via catastrophic...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528 — Flowise AI Authenticated Remote Code Executio...

Malicious code in js-logger-pack (npm)

js-logger-pack is a fake npm logger that the attacker developed openly on the registry over 23 versions across two weeks 2026-04-01 to 2026-04-15. Version 1.1.20, published hours after initial detection, is a re-obfuscation of the same payload with a new hash — same C2, same capabilities. Early...

MAL-2026-2883 Malicious code in ts-lint-builds (npm)

big.js typosquat campaign - SSH backdoor implantation, credential and crypto wallet theft --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b5b6d9da5acae076b81860b7c119f9b61dd48b9b5360e56b582fdae563f96d8 The package ts-lint-builds was found to contain malicious...

MiracleLinux 8 : nodejs:22 (AXSA:2026-432:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-432:01 advisory. brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion CVE-2026-25547 minimatch: minimatch: Denial of Service via...

PT-2026-35106

Summary The resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default configuration, the application trusts the client-supplied Host header. This allows an attacker to control the derived baseUrl,...

Malicious code in @spreadjs/js-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7909a65c6a2c928f12a2333a6e1c53c7dea90685fe7b2be35f120654a6f86d7 The package @spreadjs/js-calc was found to contain malicious code. Source: ghsa-malware...