np-audit

np-audit — npm パッケージ監査ツール npm パッケージの静的セキュリティ解析 — 難読化されたライフサイクルスクリプト、既知の脆弱性、悪意のあるパターンを実行前に 検出します。npm install と npm ci のドロップイン代替品です。 依存関係ゼロ。 純粋な Node.js 組み込みのみ。配信時 100 kB。 npx np-audit scan express npm install -g np-audit npa scan scan all deps npa install audit then install alias npm='npa' use as...

Malicious code in focaleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 481093b5037c8aafc763d4543e5a6a39c2ebc7055673eb1d4f480f885593bcd2 package.json declares the dependency 'libsignal' as 'github:rexxzyid/libsignal-node' with no tag, version, or commit SHA. On npm install, this resolv...

Malicious code in fca-raihan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 241006adda5ea773d76d48d874c80a4054215ed18f05de3e392cdd86c0379785 package.json for fca-raihan declares a dependency whose key equals the package's own name fca-raihan with source github:raihan9099/fca-raihan. This i...

Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

MAL-2026-17311 Malicious code in itsmeeaizat-bailey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e87b4292727088efa5df8326a5f868b2c6bb3ae66ee15cecc18f2fa899296075 package.json declares the libsignal dependency as git+https://github.com/whiskeysockets/libsignal-node with no tag, no commit SHA, and no integrity...

Malicious code in mfahelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...

MAL-2026-17308 Malicious code in mfahelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...

CVE-2026-45321-Tanstack

サプライチェーン攻撃シミュレーション — CVE-2026-45321 TanStack npm サプライチェーン攻撃、CI/CD の悪用、インストール時コード実行を理解するための教育用ラボ 免責事項 このプロジェクトは以下の目的のみで作成されています: サイバーセキュリティの学習、 ディフェンシブセキュリティの研究、 ローカルラボでのシミュレーション、 サプライチェーン攻撃の概念の理解。 このプロジェクトを以下の目的で使用しないでください: 実在のシステムへの攻撃、 認証情報の窃取、 マルウェアの展開、 不正アクセス、 またはその他の違法行為。 説明...

MAL-2026-16222 Malicious code in @traktis/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45eb01f2eb09b73c0660d97e76d37ab8f7d62773cab9cdbdea65039a37dbb534 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://tko.amgsec.com/depconf/traktis-core/ on every npm...

MAL-2026-15866 Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

Malicious code in @bx-ui-framework/authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80fea2ddf5689952ca33aee5f32efb088024bd1a243621b558d3cdc41ed7d57 package.json at line 14 declares a runtime dependency microfrontend whose source is a bare HTTPS URL...

EUVD-2026-68816

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...

CVE-2026-82392

A flaw was found in pnpm, a package manager. An attacker can craft a malicious pnpm-lock.yaml file that, when processed by a user running pnpm install, allows package contents to be written outside the intended nodemodules directory. If the system is configured to allow lifecycle scripts, this pa...

CVE-2026-82392

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

Malicious code in confluence-create-content (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011485304eea045bddd134da5fdabfcf9d96acd0f2c78e1800a4c32674a5788c package.json declares a dependency whose key equals the package's own name confluence-create-content and whose value is a bare HTTPS URL,...

Malicious code in confluence-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7615f50c489336db7800ea3b79ef26a4e5af311f0484ee31871000e329c2813 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/confluence-editor rather than a semver range publish...

MAL-2026-15531 Malicious code in confluence-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7615f50c489336db7800ea3b79ef26a4e5af311f0484ee31871000e329c2813 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/confluence-editor rather than a semver range publish...