Malicious code in @onereach/idw-apps (npm)

npm/@onereach/idw-apps is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

Malicious code in @or-sdk/tickets (npm)

npm/@or-sdk/tickets is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

11x-wagtail-blog (>=0.0.0 <=0.2.0), aldryn-django (>=5.0.2.0 <=5.1.5.0) +419 more potentially affected by CVE-2026-7666 via django (>=5.0.0 <=5.2.14)

django PYPI version =5.0.0, =0.0.0, =5.0.2.0, =0.0.15, =0.42.1, =1.0.0, =1.14.3, =0.0.20, =0.0.13, =0.0.19, =0.0.34, =0.0.50, =0.0.51 and more Source cves: CVE-2026-7666 Source advisory: SNYK:PYTHON-DJANGO-17151727...

a-data-processing (=0.0.1), a-mailx (=0.1.0) +1490 more potentially affected by CVE-2026-45134 via langsmith (>=0.0.10 <=0.7.38)

langsmith PYPI version =0.0.10, =0.1.0, =0.1.3, =0.1.0b0, =4.8.2, =0.1.3, =0.1.0, =0.1.0, =0.1.1, =2.1.7, =2.1.8 - agent-builder =0.0.1 and more Source cves: CVE-2026-45134 Source advisory: OSV:GHSA-3644-Q5CJ-C5C7...

ac-solver (=0.1.0), acedeploy (>=2.4.15 <=2.4.342) +764 more potentially affected by CVE-2026-44243 via gitpython (>=3.0.0 <=3.1.47)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =0.0.5, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =1.0.3, =0.1.8, =0.87.2.dev9, =0.5.0, =0.86.1 and more Source cves: CVE-2026-44243 Source advisory: SNYK:PYTHON-GITPYTHON-16438979...

a-mailx (=0.1.0), a-move-files-by-excel (>=0.1.0 <=0.1.1) +4203 more potentially affected by CVE-2026-41066 via lxml (>=3.2.3 <=6.0.4)

lxml PYPI version =3.2.3, =0.1.0, =0.1.0, =0.1.0, =0.9.1, =1.0.2, =0.1.0, =0.3.0, =0.3.5, =0.3.0, =0.3.0, =0.1.1, =0.1.0, =0.1.0, =0.5.0 and more Source cves: CVE-2026-41066 Source advisory: OSV:PYSEC-2026-87...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: falco-no-driver, opa-envoy, external-dns, falcoctl, docker-cli-buildx, kube-arangodb, dex, oras, prometheus, prometheus-operator, istio, gitleaks, apko, redka, nats, licenseclassifier, rancher, rancher-fleet, bento, splunk-otel-collector, newrelic-fluent-bit-output,...

GHSA-M4PR-4J3G-9V7V vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-kinesis-fips, kubernetes-dashboard-metrics-scraper, tempo, longhorn-manager-fips, victoriametrics, ip-masq-agent, flannel-fips, vertical-pod-autoscaler-fips, cilium-fips, etcd, github-mcp-server, loki-fips, tkn-fips, caddy, kube-vip-fips,...

01os (>=0.0.5 <=0.0.13), 3m (>=0.1.0 <=0.1.3) +2554 more potentially affected by CVE-2026-31826 via pypdf (>=3.10.0 <=6.7.5)

pypdf PYPI version =3.10.0, =0.0.5, =0.1.0, =0.0.1, =0.2.0, =0.4.0, =0.3.0, =0.3.0, =0.1.1, =0.1.0, =0.0.2, =0.2.0, =1.2.27, =3.0.145 and more Source cves: CVE-2026-31826 Source advisory: OSV:GHSA-HQMH-PPP3-XVM7...

1k-tasks (>=3.1.0 <=3.6.1), @adobe/helix-deploy (>=9.0.19 <=9.3.7) +433 more potentially affected by CVE-2026-27606 via rollup (>=3.0.0 <=3.2.5)

rollup NPM version =3.0.0, =3.1.0, =9.0.19, =6.0.3, =0.6.0, =12.0.0, =0.0.3, =1.6.3, =3.2.1, =0.1.0, =0.0.4, =3.0.1-canary.8, =3.0.1-canary.12 - @clairview/api =23.1.0 - @clairview/extensions-sdk =12.1.1 and more Source cves: CVE-2026-27606 Source advisory: SNYK:JS-ROLLUP-15340920...

amusing-app (>=0.2.0 <=0.4.2), arbi-tr-frontend (>=0.1.0 <=0.1.1) +125 more potentially affected by CVE-2026-26331 via yt-dlp (>=2023.6.22 <=2026.1.31)

yt-dlp PYPI version =2023.6.22, =0.2.0, =0.1.0, =1.1.5, =0.1.7, =1.0.0, =1.0.0, =0.1.0, =2024.3.25, =1.1.1, =0.0.2, =0.1.16, =0.4.3, =0.4.4 - depthflow =0.9.0.dev1 and more Source cves: CVE-2026-26331 Source advisory: OSV:GHSA-G3GW-Q23R-PGQM...

1shot (>=0.0.1 <=0.0.9), @3030-labs/wotw (>=0.8.4 <=0.9.0) +376 more potentially affected by CVE-2026-25724 via @anthropic-ai/claude-code (>=0.2.126 <=2.1.63)

@anthropic-ai/claude-code NPM version =0.2.126, =0.0.1, =0.8.4, =1.0.0, =2.1.0, =0.0.0-dev-20260312143810, =1.5.6, =0.1.18, =1.0.0, =0.4.0, =0.11.0 - @arach/hooked =1.1.1 and more Source cves: CVE-2026-25724 Source advisory: OSV:GHSA-4Q92-RFM6-2CQX...

@0k.io/prettier (>=0.0.2 <=0.0.3), @0k/prettier (>=0.2.0 <=0.2.1) +319 more potentially affected by CVE-2026-24001 via diff (>=4.0.1 <=4.0.2)

diff NPM version =4.0.1, =0.0.2, =0.2.0, =1.2.0, =0.3.2, =0.4.0-next.6, =7.0.0-alpha.0, =7.0.0-alpha.0, =7.0.0-alpha.0, =7.0.0-alpha.0, =7.0.0-alpha.0, =0.4.0, =1.5.0, =4.0.0, =1.0.0, =2.1.0 and more Source cves: CVE-2026-24001 Source advisory: OSV:GHSA-73RR-HH4G-FPGX...

a-mailx (=0.1.0), aba-cli-scrapper (>=0.1.1 <=0.1.6) +1115 more potentially affected by CVE-2025-69223 via aiohttp (>=3.0.0b0 <=3.13.2)

aiohttp PYPI version =3.0.0b0, =0.1.1, =0.1.0b0, =1.1.0, =1.0.1, =0.0.0, =0.0.2, =4.8.2, =0.0.3, =0.1.3, =0.4.0, =56.0.0, =0.1.0, =0.1.31, =0.1.37 and more Source cves: CVE-2025-69223 Source advisory: SNYK:PYTHON-AIOHTTP-14871876...

a-mailx (=0.1.0), almax-common (>=0.9.5 <=1.0.2.dev20240601170722) +65 more potentially affected by CVE-2025-53000 via nbconvert (>=7.0.0 <=7.16.6)

nbconvert PYPI version =7.0.0, =0.9.5, =1.0.1, =1.0.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.10, =0.0.15, =0.1.3, =3.0.0, =0.0.1, =0.0.2 - fashiontrendforecasting =0.1.0 and more Source cves: CVE-2025-53000 Source advisory: SNYK:PYTHON-NBCONVERT-14463457...

pycodium (>=0.1.0 <=0.2.1), reflex-ai (>=0.1.0a1 <=0.1.0a18) +10 more potentially affected by CVE-2025-62379 via reflex (>=0.6.0a4 <=0.8.0a7)

reflex PYPI version =0.6.0a4, =0.1.0, =0.1.0a1, =0.2.0, =0.0.1, =0.1.6, =1.0.0, =0.0.9, =10.0.11, =10.0.28 Source cves: CVE-2025-62379 Source advisory: SNYK:PYTHON-REFLEX-13560525...

a-data-processing (=0.0.1), a2a-client-handler (=0.1.0) +626 more potentially affected by CVE-2025-6984 via langchain-community (>=0.0.1 <=0.3.26)

langchain-community PYPI version =0.0.1, =0.1.0, =4.8.2, =0.1.0, =0.1.0, =0.0.2, =0.1.31, =0.0.1, =0.1.0, =0.0.1, =0.0.3.155020 - agentlite-llm =0.1.12 and more Source cves: CVE-2025-6984 Source advisory: OSV:GHSA-PC6W-59FV-RH23...

4337-snap (>=0.1.0 <=0.1.1), @0xpolygonid/snap-example (=1.0.0-beta.9) +547 more potentially affected by CVE-2025-32792 via ses (>=0.0.1 <=1.11.0)

ses NPM version =0.0.1, =0.1.0, =1.0.1-beta.0, =1.0.0, =1.6.3, =0.0.1, =19.0.0, =0.1.0, =0.1.0-beta, =0.2.3, =0.2.2, =0.1.2, =0.4.16-dev-23c942c.0, =0.4.16-dev.0 and more Source cves: CVE-2025-32792 Source advisory: OSV:GHSA-H9W6-F932-GQ62...

academic-chatgpt (>=0.3.0 <=0.4.1), africanwhisper (>=0.2.1 <=0.9.0) +151 more potentially affected by CVE-2024-39236 via gradio (>=1.7.7 <=4.33.0)

gradio PYPI version =1.7.7, =0.3.0, =0.2.1, =0.1.5, =0.0.6, =0.0.2, =0.8.11, =0.4.0, =0.7.0.dev134, =0.1.0rc1, =0.1.0rc2 - aqueduct-llm =0.0.1 and more Source cves: CVE-2024-39236 Source advisory: OSV:PYSEC-2024-274...

0lever-utils (>=0.0.2 <=0.0.7), 2keys (=0.5.1) +4904 more potentially affected by CVE-2024-37891 via urllib3 (>=1.10.2 <=1.26.18)

urllib3 PYPI version =1.10.2, =0.0.2, =0.0.2, =0.0.6, =0.1.0, =0.1.0, =0.2.0rc1, =1.0.2, =0.3.4, =0.4.6, =0.1.0, =0.5.6, =0.5.6.dev1 and more Source cves: CVE-2024-37891 Source advisory: OSV:GHSA-34JH-P97F-MPXF...