NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash

NPM: brace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.17...

ROOT-APP-NPM-CVE-2026-59875 CVE-2026-59875 in @rootio/tar - Patched by Root

Root has patched CVE-2026-59875 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

MAL-2026-11032 Malicious code in chai-as-stringify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77eb9f214b2dc10f13ecfd3239542bc27fb35bdd5d0a645b41b398d8a4a3965d [email protected] is a typosquat of chai-as-promised. The tarball ships lib/config/config.env, a 4MB heavily obfuscated JavaScript payload usin...

MAL-2026-11029 Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7ad5acb0beb469a4f953cb1e1adab206bf03ad18d45c11b5cb895b1aff79114 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11024 Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0ae70168cf816c36428f7c33d9beff0f159fbc6cd23b66eccc375e94aae4985 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11026 Malicious code in ethers-packge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 534b72f9b5ef702509f5868e85ff740c59e1e6c1f871ad0999253a062254aacd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11021 Malicious code in @bcryptln/bcryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8447904424d1fd6085c58e7a0adec80bad268c96395c885d104ee80da79c2d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NPM: Next.js: Unbounded Server Action payload in Edge runtime

NPM: Next.js: Unbounded Server Action payload in Edge runtime vulnerability discovered by ? in WordPress Npm next versions = 13.0.0, 15.5.21...

MAL-2026-11012 Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...

Malicious code in vectormark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0646473c841676e2f55d66494a805943e00b2e2d7515e1bbba5453e6a9024e [email protected] advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function getPlugin that issues an...

MAL-2026-10983 Malicious code in svelte-streaks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b07b98d6a7986da479ed75708e37dfbff0df7a6ee136f7dad1db24087bed2cf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10984 Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4618cc8c89ff606f81079aef2e98920220ca9e59ec284c8d6c18167208604a3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, prism, opensearch-dashboards, npm, kubeflow-centraldashboard, wazuh-dashboard, pulumi, gitlab-rails-ce-fips, opensearch-dashboards-fips, sqlpad, code-server, wazuh-dashboard-fips, lerna, actions-runner, kibana, homepage, saf, graalvm...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, prism, opensearch-dashboards, npm, kubeflow-centraldashboard, wazuh-dashboard, pulumi, gitlab-rails-ce-fips, opensearch-dashboards-fips, sqlpad, code-server, wazuh-dashboard-fips, lerna, actions-runner, kibana, homepage, saf, graalvm...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, prism, opensearch-dashboards, npm, kubeflow-centraldashboard, wazuh-dashboard, pulumi, gitlab-rails-ce-fips, opensearch-dashboards-fips, sqlpad, code-server, wazuh-dashboard-fips, lerna, actions-runner, kibana, homepage, saf, graalvm...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, prism, opensearch-dashboards, npm, kubeflow-centraldashboard, wazuh-dashboard, pulumi, gitlab-rails-ce-fips, opensearch-dashboards-fips, sqlpad, code-server, wazuh-dashboard-fips, lerna, actions-runner, kibana, saf, graalvm...