@holocronlab/botruntime-adk (2.2.5), @holocronlab/brt (0.7.5) potentially affected by unknown CVE via @holocronlab/botruntime-runtime (2.2.5)

@holocronlab/botruntime-runtime NPM version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on @holocronlab/botruntime-runtime and may be impacted: - @holocronlab/botruntime-adk 2.2.5 - @holocronlab/brt 0.7.5 Source cves: unknown CVE Source advisory...

@ccfly/setup (0.1.3) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.3)

@ccfly/setup-linux-x64 NPM version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.19) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.19)

@ccfly/setup-linux-x64 NPM version 0.1.19 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.19 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@apicity/mcp-server (0.8.3) potentially affected by unknown CVE via @apicity/meta (0.8.3)

@apicity/meta NPM version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@ccfly/setup (0.1.8) potentially affected by unknown CVE via @ccfly/setup-darwin-x64 (0.1.8)

@ccfly/setup-darwin-x64 NPM version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-darwin-x64 and may be impacted: - @ccfly/setup 0.1.8 Source cves: unknown CVE Source advisory: OSV:MAL-2026-12313...

Malicious code in reakt.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ff2841f53f4e574cacaa4dc1c13955afd830ecc4e34c57ef2e773477efa19a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11173 Malicious code in @ai-agent-node/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bd9860fa6b32249720b90f9ba4f48642cbd746fe04e701b05cba6eef2951671 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@whalent/agent (0.3.264) potentially affected by unknown CVE via @whalent/agent-core (0.3.264)

@whalent/agent-core NPM version 0.3.264 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.264 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.250) potentially affected by unknown CVE via @whalent/agent-core (0.3.250)

@whalent/agent-core NPM version 0.3.250 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.250 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.258) potentially affected by unknown CVE via @whalent/agent-core (0.3.258)

@whalent/agent-core NPM version 0.3.258 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.258 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.297) potentially affected by unknown CVE via @whalent/agent-core (0.3.297)

@whalent/agent-core NPM version 0.3.297 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.297 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.282) potentially affected by unknown CVE via @whalent/agent-core (0.3.282)

@whalent/agent-core NPM version 0.3.282 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.282 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.265) potentially affected by unknown CVE via @whalent/agent-core (0.3.265)

@whalent/agent-core NPM version 0.3.265 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.265 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.243) potentially affected by unknown CVE via @whalent/agent-core (0.3.243)

@whalent/agent-core NPM version 0.3.243 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.243 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

@whalent/agent (0.3.298) potentially affected by unknown CVE via @whalent/agent-core (0.3.298)

@whalent/agent-core NPM version 0.3.298 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.298 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10722...

MAL-2026-7062 Malicious code in @combinezone/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-9062 Malicious code in uxjinalamb2 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7905 Malicious code in lbcaltestcwukld (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7866 Malicious code in lamhgtestgoog13067 (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-6055 Malicious code in @mastra/node-speaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d1fc45cd66b93c4e1a83c1743f1ac9ee3ebea854208b1a9cae83ee957ebfd83 @mastra/node-speaker is a PCM audio output library wrapping native mpg123 bindings. Its package.json declares 'easy-day-js' ^1.11.21 as a runtime...