Malicious code in @bx-ui-framework/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b8886bf47df30ba72e888647d651e72defd41c1172a4307c438562183d7a32 package.json declares a dependency whose key equals the package's own name @bx-ui-framework/common and whose value is a bare HTTPS URL...

EUVD-2026-68816

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...

CVE-2026-82392

A flaw was found in pnpm, a package manager. An attacker can craft a malicious pnpm-lock.yaml file that, when processed by a user running pnpm install, allows package contents to be written outside the intended nodemodules directory. If the system is configured to allow lifecycle scripts, this pa...

CVE-2026-82392

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

Malicious code in mfaatest (npm)

Source: amazon-inspector 73e4ce261829117e316f9152160cdcb35c6ba66064f631baba1f8d528673b584 package.json declares dependency node-net-pool with its value set to an arbitrary HTTPS tarball URL https://limbomail.com/api/attachment/fpwvxc9DvM.Bjuueu1K2SkBCKkgATls-oq05UsrNNY/pkg.tgz rather than a...

Malicious code in tabbables (npm)

Source: amazon-inspector 2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb package.json at line 11 declares a dependency whose key equals the package's own name tabbables and whose value is the raw HTTPS URL https://repo.securityctrl.com/tabbables rather than a registry version...

Malicious code in sycm-vendors (npm)

Source: amazon-inspector b6a876475c44d594b90a19bc6c9bb3d5be6f6d0a19091218ef5e03f92e1b86e1 package.json declares a self-named dependency 'sycm-vendors' whose source is the bare URL https://repo.securityctrl.com/sycm-vendors rather than a registry version range, with no version pin and no integrity...

Malicious code in search-reservation (npm)

Source: amazon-inspector 76642f0709b362fd800a9842b53bdb8f26413b9acf26562c4a5737c7bae3e856 package.json declares a dependency whose key equals the package's own name search-reservation and whose value is the bare URL https://repo.securityctrl.com/search-reservation instead of a registry version...

Malicious code in mintel-taskbar (npm)

Source: amazon-inspector 5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/mintel-taskbar, not a registry version range. On npm...

Malicious code in nx-app (npm)

Source: amazon-inspector 8671a9b563cebe9de36365a80edc1f242be492933cadb3e45ea590c8c5e1e115 package.json declares its own name nx-app as a dependency whose value is a raw HTTPS URL https://repo.securityctrl.com/nx-app rather than a semver range against the npm registry. On npm install, npm fetches ...

Malicious code in data-value (npm)

Source: amazon-inspector aa1f0fee2d6635331e603f520ba2954b11ac9e85bbd5b66f27c18be5940c3041 package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL https://repo.securityctrl.com/data-value rather than a registry version range. On npm install,...

Malicious code in katal-logger (npm)

Source: amazon-inspector 8ff7c110d8766d130db16799f1875e420bdaba20866624b593a209ace7a49d6a package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/katal-logger instead of a registry version range. On npm install, npm fetches whatever bytes that URL currentl...

Malicious code in firestore-lite (npm)

Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version range. On npm install, npm fetches and installs whatever...

Malicious code in gridster-coords (npm)

Source: amazon-inspector 245882b881fde3396fcb6e1e14f8b0014fc64cd1d02d27f101c8fd2a0b16c944 package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridster-coords instead of a registry version range. On npm install, npm fetches whatever...

Malicious code in paper-password-input (npm)

Source: amazon-inspector a97853ce25938b0cc295a798fa8c9ae8ab513126e70b93084785636a91bc7ec4 package.json declares a dependency whose key equals the package's own name paper-password-input and whose value is a bare HTTPS URL, https://repo.securityctrl.com/paper-password-input, rather than a registry...

Malicious code in amplitude-session-replay (npm)

Source: amazon-inspector fb71ca2dc9e74e42a64b1533ecb98ea1cad26e283b0c3d3ba0f4e7c760fac713 package.json declares a dependency whose key is the package's own name amplitude-session-replay and whose value is a plain HTTPS URL, https://repo.securityctrl.com/amplitude-session-replay, instead of a...

Malicious code in sentrykit (npm)

Source: amazon-inspector 7070cc1752fa75b405bdd0617a934d29519df28fdd0d069c0d4b5f7adaf44f55 package.json declares a self-referential dependency where the key sentrykit maps to the bare HTTPS URL https://repo.securityctrl.com/sentrykit instead of a registry version range. On npm install, npm fetches...

Malicious code in loading-performance-instrumentation (npm)

Source: amazon-inspector 27dab9307010475c57195f838ba7d7299fe4a753b92926536aa8376f8d096150 package.json line 11 declares a dependency whose source is a bare URL rather than a registry version range: "loading-performance-instrumentation":...