@holocronlab/botruntime-adk (2.2.5), @holocronlab/brt (0.7.5) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.2.5)

@holocronlab/botruntime-runtime NPM version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk 2.2.5 - @holocronlab/brt 0.7.5 Source cves: unknown CVE Source advisory...

@ccfly/setup (0.1.3) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.3)

@ccfly/setup-linux-x64 NPM version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.19) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.19)

@ccfly/setup-linux-x64 NPM version 0.1.19 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.19 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@apicity/mcp-server (0.8.3) potentially affected by unknown CVE via @apicity/meta (0.8.3)

@apicity/meta NPM version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@ccfly/setup (0.1.8) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.8)

@ccfly/setup-darwin-x64 NPM version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.8 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

@whalent/agent (0.3.297) potentially affected by unknown CVE via @whalent/agent-core (0.3.297)

@whalent/agent-core NPM version 0.3.297 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.297 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.258) potentially affected by unknown CVE via @whalent/agent-core (0.3.258)

@whalent/agent-core NPM version 0.3.258 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.258 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.265) potentially affected by unknown CVE via @whalent/agent-core (0.3.265)

@whalent/agent-core NPM version 0.3.265 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.265 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.243) potentially affected by unknown CVE via @whalent/agent-core (0.3.243)

@whalent/agent-core NPM version 0.3.243 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.243 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.282) potentially affected by unknown CVE via @whalent/agent-core (0.3.282)

@whalent/agent-core NPM version 0.3.282 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.282 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.250) potentially affected by unknown CVE via @whalent/agent-core (0.3.250)

@whalent/agent-core NPM version 0.3.250 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.250 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.264) potentially affected by unknown CVE via @whalent/agent-core (0.3.264)

@whalent/agent-core NPM version 0.3.264 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.264 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.298) potentially affected by unknown CVE via @whalent/agent-core (0.3.298)

@whalent/agent-core NPM version 0.3.298 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.298 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

MAL-2026-7062 Malicious code in @combinezone/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-9062 Malicious code in uxjinalamb2 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7905 Malicious code in lbcaltestcwukld (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7866 Malicious code in lamhgtestgoog13067 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-6055 Malicious code in @mastra/node-speaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1fc45cd66b93c4e1a83c1743f1ac9ee3ebea854208b1a9cae83ee957ebfd83 @mastra/node-speaker is a PCM audio output library wrapping native mpg123 bindings. Its package.json declares 'easy-day-js' ^1.11.21 as a runtime...

Malicious code in @mastra/turbopuffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73c50676f96c5af47167ce4405b1f53a38feb3cbd8a3eaf93fe262479680403 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5685 Malicious code in @malwguy/ecto-corsair-whisper-3d2a7c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b95a5cb65b01f03aebc1ab713877cb963b5de2cb4ddc38c03cdb01a7e469144 On npm install, postinstall.js walks /, /app, /home, /opt, /root for files whose names match /flag|secret|env/i, reads their contents, scrapes...