aurora-demo-lockfile

aurora-demo-lockfile Demo target for AURORA — the UiPath for Coding Agents challenge submission at mlbrilliance/uipath-for-coding-agents. This repo intentionally contains three vulnerable lockfiles so AURORA's Maestro process OssSupplyChainDefender has something to detect, triage, and remediate. ...

shai-scan

shai-scan Zero-dependency CLI scanner for npm and PyPI supply chain compromises. Why? On May 11, 2026, a self-propagating supply chain worm dubbed Mini Shai-Hulud CVE-2026-45321, GHSA-g7cv-rxg3-hmpx compromised the npm ecosystem. Attributed to TeamPCP aka DeadCatx3, PCPcat, ShellForce, CipherForc...

cve-lite-on-pi

cve-lite-on-pi 在 pi 单体仓库上运行 CVE Lite CLI 的简短报告及其发现。 背景 本实验的灵感来自文章 "OWASP CVE Lite CLI – 用于扫描项目中漏洞的新工具" （CyberSecurityNews）。 什么是 CVE Lite CLI？ CVE Lite CLI 是一个面向开发者的、本地 的命令行扫描器，适用于 JavaScript/TypeScript 项目。它无需安装或运行你的依赖项，而是读取你的锁文件 （package-lock.json、pnpm-lock.yaml、yarn.lock 或...

EUVD-2026-68816

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...

PT-2026-84039

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions 11.0.0 through 11.10.0 Description pnpm improperly parses package names from the pnpm-lock.yaml file using the dp.parsedepPath.name function without sufficient validation. This occurs within...

CVE-2026-59196

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to manipulate the package installation process by using a specially crafted lockfile alias. This could lead to path traversal, enabling the attacker to write files outside the designated installation director...

Malicious code in dolyame-boxy-independent-bnpl-cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2211179bcef10cb641d7ad848be2a71a3048d90108c4651b471ba60404f2d2 On import, index.js requires setup.js, which downloads an opaque binary from string-split-obfuscated Cloudflare Workers hosts...

MAL-2026-13327 Malicious code in dolyame-boxy-independent-bnpl-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce523b3385816616192d462b5ac251d22886682d021200c4bd76bd22b95003c On require of this package, index.js loads setup.js which downloads a platform-specific native binary from author-controlled Cloudflare Workers hosts...

Malicious code in tramvai-module-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8841208443b6595c8389bfac3e1cdb59a65ad0bc05a8dd3e01ca5c661287e56 On require of the package, index.js loads setup.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12184 Malicious code in peter-desktop-peter-big-column (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7593cd2f0f03765e6debc06626ee5d771a32e0d7eb579ddca1bfc5ca53bc22e6 On require, index.js loads runtime.js which assembles download hostnames at runtime from split string fragments resolving to...

nono-cli'scregistry pack verification can fail open when provenance metadata is absent

Summary Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant: - /.config/nono/packages/lockfile.json - /.config/nono/packages///.nono-trust.bundle Testing shows that nono fails closed when a pack has a trust bundle b...

[SECURITY] Fedora 44 Update: uv-0.11.28-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

[SECURITY] Fedora 43 Update: uv-0.11.28-1.fc43

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

CVE-2026-59195

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under nodemodules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml who...

CVE-2026-59196

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted nodemodules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fix...

CVE-2026-59195

CVE-2026-59195 affects pnpm prior to versions 10.34.4 and 11.8.0. The issue arises when pnpm reads package names from the env lockfile’s configDependencies section and uses those names directly to create config dependency symlinks under node_modules/.pnpm-config. A crafted pnpm-lock.yaml with a t...

CVE-2026-59195

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under nodemodules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml who...

CVE-2026-59195

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under nodemodules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml who...

CVE-2026-59195 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under nodemodules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml who...

CVE-2026-59195 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under nodemodules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml who...