@apicity/mcp-server (0.8.5) potentially affected by unknown CVE via @apicity/meta (0.8.5)

@apicity/meta NPM version 0.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.5 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.6) potentially affected by unknown CVE via @apicity/meta (0.8.6)

@apicity/meta NPM version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.6 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

@apicity/mcp-server (0.8.8) potentially affected by unknown CVE via @apicity/meta (0.8.8)

@apicity/meta NPM version 0.8.8 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.8 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...

MAL-2026-13401 Malicious code in helmet-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402 [email protected] is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawn...

Malicious code in @xsat10/baileys-xsat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37ba86faab85b50d9ae903ee59c78a8b52e46797b4c003448cd9851cd774939b Package is a fork of the Baileys WhatsApp Web library. Static keyword co-occurrence patterns matched on lib/Utils/generics.js ping/GET references and...

safe-chain v1.5.15

Aikido Safe Chain ✅ Block malware on developer laptops and CI/CD ✅ Supports npm and PyPI more package managers coming ✅ Blocks packages newer than 48 hours without breaking your build ✅ Tokenless, free, no build data shared Need protection beyond npm & PyPI? Aikido Device Protection builds on Saf...

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from...

Malicious code in solana-sniper-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1140920c05a1ce00ca8d35295fb927d1bbb2ca9fe2f8e7ab9f63f9391ca6476b During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...

MAL-2026-13346 Malicious code in hdkey-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b36c64fed7b6d50787a971cc649c1f97605f6ea7027f388e9185ea85a580013 On module load, index.js reads the complete process.env object along with hostname, username, home directory, platform, and current working directory...

Malicious code in bigops-outgoing-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 536ee260eadf72447df4e01eb549a86779846d21b3b9b539b486f2bcd65ba750 On require of index.js the package loads runtime.js, which selects a platform-specific asset path and fetches an opaque binary from one of four...

MAL-2026-13243 Malicious code in bigops-products-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265e87afdb04434bf53739963fd1c91ddb80c8ac957384377898c0aaf87cf826 On require'bigops-products-mobile', index.js loads loader.js which selects a platform-specific binary path, fetches attacker-controlled bytes over...

Malicious code in bigops-products-savings-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 390c683f6a93a099bb09a5590ebc84cd61391ee25d553d009350117c142a9c43 On require of bigops-products-savings-accounts, ext.js reconstructs C2 hostnames via Array.join to defeat static search, fetches a platform-specific...

MAL-2026-13244 Malicious code in bigops-products-savings-accounts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 390c683f6a93a099bb09a5590ebc84cd61391ee25d553d009350117c142a9c43 On require of bigops-products-savings-accounts, ext.js reconstructs C2 hostnames via Array.join to defeat static search, fetches a platform-specific...

Malicious code in docker-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f02e61d324161238593fb7e59dc907f183bf885a908354fed1eba0662906947b [email protected] is a typosquat of dockerode. On require, index.js collects hostname, username, homedir, platform, cwd, and the entire...

MAL-2026-13287 Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

Malicious code in dolyame-boxy-component-story-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32 On require of this package, support.js reconstructs Cloudflare Workers hostnames from split string fragments e.g...

MAL-2026-13308 Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

MAL-2026-13303 Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...

MAL-2026-13311 Malicious code in dolyame-boxy-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00cfc61444739291be87199c8b4118dd762690f12041bdadcd6b5792b4a3c9c3 On require of dolyame-boxy-fonts, index.js unconditionally loads./loader.js, which reconstructs C2 hostnames from split-string arrays Cloudflare...

Malicious code in dolyame-boxy-independent-bnpl-tiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4340fab762980b85544094ef1795fd82968bb58c7fe0f17a00f50b2df89b29d5 On require of the package, index.js loads setup.js, which reconstructs attacker-controlled hostnames by splitting string literals across arrays and...