236626 matches found
Malicious code in kijai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86481ee3f08109eeaec60a41afb7c2e8d03efd680cc5bf846bdc342ec4205205 The package advertises itself as a high-throughput bulk-mail tool and ships every one of its 50 JS files cli.js, denv.js, helpers.js, all commands/.j...
Malicious code in calvora (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc3f7e9ef1bbc85d0303406eac1b28cace865d65ab2bbad1104ba2f0adaaa78 index.mjs auto-invokes a sync routine at module import. Under Linux with NODEENV!= production and access to a WSL /mnt/c mount, it locates a Windows...
Malicious code in calmora (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...
Malicious code in veskr (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05d4b49dfdad9ef3eb4605e61998fab98f41bb282c48020b91492ea25f0c0d97 No a static rule matches and no traced code behavior indicating exfiltration, install-time remote code execution, silent relay, credential...
Malicious code in vectormark (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0646473c841676e2f55d66494a805943e00b2e2d7515e1bbba5453e6a9024e [email protected] advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function getPlugin that issues an...
Malicious code in react-tabulix-extended (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...
MAL-2026-10983 Malicious code in svelte-streaks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de19bce1fef8c7cc16b9066720070e2181816e07551ecd8435baea09c607ed6 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicative of credential theft, install-time code executio...
NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter
NPM: fast-uri vulnerable to host confusion via literal backslash authority delimiter vulnerability discovered by ? in WordPress Npm fast-uri versions = 2.3.1, = 2.4.2...
MAL-2026-10979 Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...
MAL-2026-10984 Malicious code in veskra (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
GHSA-W8WR-V893-VJVP vulnerabilities
Vulnerabilities for packages: kubeflow-centraldashboard, code-server, actions-runner, npm, sqlpad, kibana, pulumi, saf, lerna, wazuh-dashboard, graalvm, opensearch-dashboards, opensearch-dashboards-fips, homepage, gitlab-rails-ce, prism, gitlab-rails-ce-fips, wazuh-dashboard-fips...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: kubeflow-centraldashboard, code-server, actions-runner, npm, sqlpad, kibana, pulumi, saf, lerna, wazuh-dashboard, graalvm, opensearch-dashboards, opensearch-dashboards-fips, homepage, gitlab-rails-ce, prism, gitlab-rails-ce-fips, wazuh-dashboard-fips...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: kubeflow-centraldashboard, code-server, actions-runner, npm, sqlpad, kibana, pulumi, saf, lerna, wazuh-dashboard, graalvm, opensearch-dashboards, opensearch-dashboards-fips, homepage, gitlab-rails-ce, prism, gitlab-rails-ce-fips, wazuh-dashboard-fips...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: kubeflow-centraldashboard, code-server, actions-runner, npm, sqlpad, kibana, pulumi, saf, lerna, wazuh-dashboard, graalvm, opensearch-dashboards, opensearch-dashboards-fips, gitlab-rails-ce, prism, gitlab-rails-ce-fips, wazuh-dashboard-fips...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: kubeflow-centraldashboard, code-server, saf, npm, prism, sqlpad, lerna, pulumi...