GHSA-35P6-XMWP-9G52 vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, saf, pelias-api, py3-captum, renovate, kibana, prism, vitess, code-server, haraka, npm, node-gyp...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, saf, pelias-api, py3-captum, renovate, kibana, prism, vitess, code-server, haraka, npm, node-gyp...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: gemini-cli, actions-runner, saf, pelias-api, py3-captum, renovate, kibana, prism, vitess, code-server, haraka, npm, node-gyp...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: npm, saf, code-server, prism, renovate, node-gyp, vitess...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: npm, saf, code-server, prism, renovate, node-gyp, vitess...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: npm, saf, code-server, prism, renovate, node-gyp, vitess...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: npm, saf, code-server, prism, renovate, node-gyp, vitess...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: npm, saf, code-server, prism, renovate, node-gyp, vitess...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: npm, saf, code-server, prism, renovate, node-gyp, vitess...

GHSA-VXPW-J846-P89Q vulnerabilities

Vulnerabilities for packages: npm, saf, code-server, prism, renovate, node-gyp, vitess...

ROOT-APP-NPM-CVE-2025-54798 CVE-2025-54798 in @rootio/tmp - Patched by Root

Root has patched CVE-2025-54798 in the @rootio/tmp package for Root:npm. Multiple fixed versions available...

MAL-2026-6249 Malicious code in blinkit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8 On npm install, the package's preinstall lifecycle hook runs curl against http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/ and POSTs the installer...

Malicious code in zomato-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1b48a397992964f8f3982dc69a33431bfb26c911c29a1e5d124581cef46a40 Dependency-confusion package targeting an internal Zomato namespace. The package ships only a stub index.js module.exports = name: 'zomato-config',...

MAL-2026-6261 Malicious code in sf-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a1a34bbf1dc84732509c5c5bfbd65adcd442b2665367d0c1bd39dc8301001c On require'sf-storybook', index.js shells out via childprocess to run cat /etc/passwd ./passwd.txt and then POSTs the file contents via curl to...

MAL-2026-6217 Malicious code in aikaf788812 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c91950cef6a5f877a4a9bca074501e4c910dc50008d4c8c2623ddc21f08e31f2 Package masquerades as a string-utility library but ships a postinstall backdoor. On npm install, scripts/postinstall.js spawns scripts/shell.js as a...

MAL-2026-6200 Malicious code in assert-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e21fa9c37e9944a00f7e85c7476f8fd4dc6bcd1f8fcd064a90488ef93d5bd12 [email protected] impersonates the chai assertion library bundles chai's source, contributors, and API surface under a different author and homepage...

NPM: OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install

NPM: OpenClaw: Workspace .env npmexecpath could influence bundled runtime dependency install vulnerability discovered by ? in WordPress Npm openclaw versions 2026.4.29...

OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency install

Summary Workspace .env npmexecpath could influence bundled runtime dependency install. In affected versions, a workspace .env in a repository opened by a trusted operator could override the package-manager executable path used by the install helper. This advisory is scoped to the named feature an...

MAL-2026-6132 Malicious code in metavu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc05e6833390f96b1a53f5d1612e613436e5002673da2f7a8c1e8e9f9f41c525 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects hostname, platform, architecture, home...

NPM: OpenClaw: Shell inline-command parsing could miss an allowlist check

NPM: OpenClaw: Shell inline-command parsing could miss an allowlist check vulnerability discovered by ? in WordPress Npm openclaw versions = 2026.5.10-beta.1...