Malicious code in event-bus-lite-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721 The package ships a binding.gyp whose target has type "none" and no C/C++ source files; its only purpose is a GYP !... command-expansion that runs no...

MAL-2026-18292 Malicious code in event-bus-lite-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 038b62e6040cef7e651f3cf89c146290f391c28977fe206410408e85ccbe4721 The package ships a binding.gyp whose target has type "none" and no C/C++ source files; its only purpose is a GYP !... command-expansion that runs no...

Malicious code in @ppa-web-components/ppa-navigation (npm)

Source: amazon-inspector c88c344e72bb7cf5ae6f5e6185a1024caf8b96bce96584d448609ab78cd894af The package is a shim whose only functional payload is a beacon. package.json declares a postinstall that runs node beacon.cjs, and index.js additionally invokes require'./beacon.cjs'.fire on load, so the...

n8n 2.36.1 Git Node Remote Code Execution

n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. A repository-local Git content-filter configuration can execute a command during a Git operation. https://packetstorm.news/download/237473...

Exploit for OS Command Injection in N8N

CVE-2026-85168 — n8n Git node RCE via repository-local git con...

CLEANSTART-2026-OM39297 undici is an HTTP client library for Node

Security vulnerability affects the npm package. undici is an HTTP client library for Node...

CLEANSTART-2026-LB99880 undici is an HTTP client library for Node

Security vulnerability affects the npm package. undici is an HTTP client library for Node...

CLEANSTART-2026-XE59858 undici is an HTTP client library for Node

Security vulnerability affects the npm package. undici is an HTTP client library for Node...

Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

365center-mcp (>=1.0.0, <=1.4.0), 3d-db (0.1.5) +4692 more potentially affected by CVE-2026-109461 via @azure/msal-node (>=5.0.3, <=7.0.1)

@azure/msal-node NPM version =5.0.3, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =1.0.0, =0.1.0, =0.0.1-alpha.3, =0.0.1, =1.0.0, =0.1.0, =18.0.0-alpha.2, =20.0.0-renovate-fd1892-me5sbqz0 and more Source cves: CVE-2026-109461 Source advisory: SNYK:JS-AZUREMSALNODE-21689163...

365center-mcp (>=1.0.0, <=1.4.0), 3d-db (0.1.5) +4692 more potentially affected by CVE-2026-109461 via @azure/msal-node (>=5.0.3, <=7.0.1)

@azure/msal-node NPM version =5.0.3, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =1.0.0, =0.1.0, =0.0.1-alpha.3, =0.0.1, =1.0.0, =0.1.0, =18.0.0-alpha.2, =20.0.0-renovate-fd1892-me5sbqz0 and more Source cves: CVE-2026-109461 Source advisory: OSV:GHSA-XCX6-JX8P-X3H5...

365center-mcp (>=1.0.0, <=1.4.0), 3d-db (0.1.5) +4692 more potentially affected by CVE-2026-109461 via @azure/msal-node (>=5.0.3, <=7.0.1)

@azure/msal-node NPM version =5.0.3, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.11, =1.0.0, =0.1.0, =0.0.1-alpha.3, =0.0.1, =1.0.0, =0.1.0, =18.0.0-alpha.2, =20.0.0-renovate-fd1892-me5sbqz0 and more Source cves: CVE-2026-109461 Source advisory: GHSA-XCX6-JX8P-X3H5...

Origin Validation Error

Overview @azure/msal-node is a Microsoft Authentication Library for Node Affected versions of this package are vulnerable to Origin Validation Error via the acquireTokenByCode method in ConfidentialClientApplication, which fails to sanitize the caller-supplied authCodePayload before use. An...

MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint

Impact Origin validation error in Microsoft Authentication Library MSAL for Node.js allows an unauthorized attacker to disclose information over a network. This affects the authcode flow. Patches Version 7.1.0 and higher are patched. Workarounds Ensure you pass in only the authcode to to...

Malicious code in @greenlake/auth (npm)

@greenlake/auth is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 3.0.0 has a postinstall script that runs node beacon.cjs on npm install, and index.js...

GHSA-RXP7-6HXX-X8Q5 vulnerabilities

Vulnerabilities for packages: actions-runner, unleash-proxy, wazuh-dashboard-fips, prism, unleash, lerna, code-server, node-red, eco-jess, homepage, wazuh-dashboard, npm...

@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-win32-arm64-msvc (>=3.0.0, <=3.33.1)

@fallow-cli/fallow-node-win32-arm64-msvc NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-linux-x64-gnu (>=3.0.0, <=3.33.1)

@fallow-cli/fallow-node-linux-x64-gnu NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-linux-x64-musl (>=3.0.0, <=3.33.1)

@fallow-cli/fallow-node-linux-x64-musl NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...

@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-win32-x64-msvc (>=3.0.0, <=3.33.1)

@fallow-cli/fallow-node-win32-x64-msvc NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...