267464 matches found
ROOT-APP-NPM-CVE-2026-44005 CVE-2026-44005 in vm2 - Patched by Root
Root has patched CVE-2026-44005 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-43998 CVE-2026-43998 in vm2 - Patched by Root
Root has patched CVE-2026-43998 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44003 CVE-2026-44003 in vm2 - Patched by Root
Root has patched CVE-2026-44003 in the vm2 package for Root:npm. Multiple fixed versions available...
Malicious code in hardhat-deep (npm)
Source: amazon-inspector fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304 The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree README, SECURITY.md, index.d.ts, lib/proto.js, lib/transport.js, lib/worker.js, lib/levels.js,...
Malicious code in mfasolver (npm)
Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz — an off-registry HTTP source pointing at the mutabl...
Malicious Package
Overview node-env-resolve is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview node-fetch-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview node-gyp-runtime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview @xayz/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview @bellaxchuu/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)
@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...
CVE-2026-106510
A flaw was found in plugin-techdocs-node. An authenticated attacker with permissions to register catalog entities can achieve arbitrary code execution by submitting a crafted documentation configuration file. When the documentation is built, the malicious markdown extensions setting triggers...
CVE-2026-106556
A flaw was found in the Backstage plugin-techdocs-node component. Insufficient validation of documentation configuration files during documentation generation allows sanitization checks to be bypassed. An authenticated user with permission to register or modify documentation sources can exploit...
ROOT-APP-NPM-CVE-2026-31938 CVE-2026-31938 in jspdf - Patched by Root
Root has patched CVE-2026-31938 in the jspdf package for Root:npm. Multiple fixed versions available...
MAL-2026-17663 Malicious code in mfasolver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...
Malicious code in mfasolver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...
Malicious code in hardhat-deep (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304 The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree README, SECURITY.md, index.d.ts, lib/proto.j...
CLEANSTART-2026-CA85404 undici's experimental WebSocketStream client crashes the whole Node
CVE-2026-85014 affects multiple packages. undici's experimental WebSocketStream client crashes the whole Node. See references for individual vulnerability details...
CLEANSTART-2026-CK85673 undici's WebSocket client crashes the whole Node
CVE-2026-19534 affects multiple packages. undici's WebSocket client crashes the whole Node. See references for individual vulnerability details...