MAL-2026-7079 Malicious code in @karakuri-web-fgsfgehfg/common (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7078 Malicious code in @jesusvizcaino2021/app-push-base (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7072 Malicious code in @gs-select/client-sbl-application (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7067 Malicious code in @driivz/component-library (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7066 Malicious code in @deathpoolxrs/dependency-confusion-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 074dc1352aecc512f6de67bd23de8f920559302127e1d6da86a9001a499c6adf The package was found to contain malicious code or consuming dependency that contains malicious code...

MAL-2026-7064 Malicious code in @dany47/csec-form-helpers (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7060 Malicious code in @cashback/postal-premium (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7050 Malicious code in @bmg-web/bmg-core (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7049 Malicious code in @athena-ui-components/utils (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7048 Malicious code in @athena-ui-components/user-activity (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7045 Malicious code in @athena-ui-components/lang (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7043 Malicious code in @athena-ui-components/helpers (npm)

--- -= Per source details. Do not edit below this line.=-...

ROOT-APP-NPM-CVE-2026-35213 CVE-2026-35213 in @rootio/hapi__content - Patched by Root

Root has patched CVE-2026-35213 in the @rootio/hapicontent package for Root:npm. Multiple fixed versions available...

MAL-2026-10655 Malicious code in @pimy-b2cweb/apiclient-b2cweb-r2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e81b01be81080333f758249c9b2b33eea63eff7eb1d10c62c6b42288e99a227 The OpenSSF Package Analysis project identified '@pimy-b2cweb/apiclient-b2cweb-r2' @ 99.99.99 npm as malicious. It is considered malicious...

Malicious code in @higherlogic/ocfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bbd559291bd6c2d7889aebe011bb43bef61938171904f5c9ff378f33fd9e5e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chai-spycore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbb99516f251bbd13baae5273239a6a04acefea76ddf1a7b06f4b5a328339dae Package republishes the chai-spies Chai plugin source verbatim including original author header under the near-identical name chai-spycore...

NPM: Decompress: Archive extraction can create files and links outside of the target directory

NPM: Decompress: Archive extraction can create files and links outside of the target directory vulnerability discovered by ? in WordPress Npm decompress versions = 4.2.1...

MAL-2026-6906 Malicious code in xnder-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aeeac149a5afa4797eea935b2a54b66fcf2cfd939fce855655208245ba9e5a7 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation of th...

MAL-2026-6901 Malicious code in vite-plugin-svg-paths (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3808a0ad54ecf36bb7d7da093b2a9982c01b87bcadb4ada918552c1738cf7fba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in windrule-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12204dba8f73baf0bb7f6ce1ebd80bb2ce689752abaea290e1429aed4037bb9c No suspicious behaviors were observed in this package version. There are no lifecycle scripts fetching or executing remote code, no hardcoded...