Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint

Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...

MAL-2026-10984 Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: code-server, gitlab-rails-ce-fips, npm, prism, actions-runner, opensearch-dashboards, kibana, wazuh-dashboard-fips, opensearch-dashboards-fips, pulumi, homepage, kubeflow-centraldashboard, lerna, sqlpad, gitlab-rails-ce, saf, graalvm, wazuh-dashboard...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: code-server, gitlab-rails-ce-fips, npm, prism, actions-runner, opensearch-dashboards, kibana, wazuh-dashboard-fips, opensearch-dashboards-fips, pulumi, homepage, kubeflow-centraldashboard, lerna, sqlpad, gitlab-rails-ce, saf, graalvm, wazuh-dashboard...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: code-server, gitlab-rails-ce-fips, npm, prism, actions-runner, opensearch-dashboards, kibana, wazuh-dashboard-fips, opensearch-dashboards-fips, pulumi, homepage, kubeflow-centraldashboard, lerna, sqlpad, gitlab-rails-ce, saf, graalvm, wazuh-dashboard...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: code-server, gitlab-rails-ce-fips, npm, prism, actions-runner, opensearch-dashboards, kibana, wazuh-dashboard-fips, opensearch-dashboards-fips, pulumi, kubeflow-centraldashboard, lerna, sqlpad, gitlab-rails-ce, saf, graalvm, wazuh-dashboard...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: pulumi, code-server, lerna, npm, prism, kubeflow-centraldashboard, saf, sqlpad...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: pulumi, code-server, lerna, npm, prism, kubeflow-centraldashboard, saf, sqlpad...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: pulumi, code-server, lerna, npm, prism, kubeflow-centraldashboard, saf, sqlpad...

ROOT-APP-NPM-AIKIDO-2026-10689 AIKIDO-2026-10689 in @rootio/vm2 - Patched by Root

Root has patched AIKIDO-2026-10689 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44003 CVE-2026-44003 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-44003 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10841 AIKIDO-2026-10841 in @rootio/vm2 - Patched by Root

Root has patched AIKIDO-2026-10841 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-24118 CVE-2026-24118 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-24118 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

MAL-2026-10968 Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...

MAL-2026-10966 Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...

MAL-2026-10971 Malicious code in cxpw-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2288ef5dfb841556f7ba4907a025270dfda3439820215b7d98e644afca78a306 cxpw-offers ships an empty index.js and declares its only dependency ltidisafe as a direct tarball URL at...

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.16...

Malicious code in lwc-slds-lbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...

MAL-2026-10920 Malicious code in alb-lambda-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...