@edoday/react-sdk (>=1.2.0, <=1.2.1), weavedb-client (>=0.9.2, <=0.45.4) +5 more potentially affected by unknown CVE via weavedb-base (>=0.9.7, <=0.45.4)

weavedb-base NPM version =0.9.7, =1.2.0, =0.9.2, =0.8.0, =0.21.0, =0.9.0, =0.9.0, =0.45.2 Source cves: unknown CVE Source advisory: GHSA-XJ9G-9FF6-G755...

MAL-2026-4721 Malicious code in weavedb-node-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d174728fc7469b023ece1980797185c35abd74c56e253bc1dc1b295a46a1dbd2 package.json declares "preinstall": "./tools/setup", unconditionally executing a 976KB UPX-packed, stripped Linux x86 ELF on every npm install. The...

Malicious code in weavedb-node-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d174728fc7469b023ece1980797185c35abd74c56e253bc1dc1b295a46a1dbd2 package.json declares "preinstall": "./tools/setup", unconditionally executing a 976KB UPX-packed, stripped Linux x86 ELF on every npm install. The...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the node.event process. An attacker can gain unauthorized access to gateway-side tools and execute arbitrary code by dispatching unrestricted agent requests fro...

Malware in spex-node-client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in spex-node-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a39b71a7706221a863e8129674f28f4e5a1aec4ad4dfca5cdb243a0a4916901 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MySQL2 security vulnerabilities

MySQL2 is a MySQL client for Node.js by the individual developer Andrey Sidorov. A security vulnerability exists in MySQL2 versions prior to 3.9.3, which stems from incorrect input validation via the keyFromFields function, leading to cache poisoning...

com.jamshedalamqaderi.ktransport:generate-proto (>=0.0.1-dev-17, <=1.0.6), com.wavesenterprise:we-contract-sdk-grpc (>=1.0.0, <=1.2.0) +7 more potentially affected by CVE-2022-3171 via com.google.protobuf:protobuf-kotlin (3.20.1)

com.google.protobuf:protobuf-kotlin MAVEN version 3.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.google.protobuf:protobuf-kotlin and may be impacted: - com.jamshedalamqaderi.ktransport:generate-proto =0.0.1-dev-17, =1.0.0, =0.2.0, =0.2.0,...

Malicious Package

Overview opentelemerty-node-client is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...