138452 matches found
GHSA-P88M-4JFJ-68FV vulnerabilities
Vulnerabilities for packages: saf, npm, py3-captum, kibana, code-server, vitess, node-gyp, commercial-gitlab-rails-ee-fips, actions-runner, commercial-gitlab-rails-ee, renovate, haraka, prism, gemini-cli, pelias-api...
GHSA-35P6-XMWP-9G52 vulnerabilities
Vulnerabilities for packages: saf, npm, py3-captum, kibana, code-server, vitess, node-gyp, commercial-gitlab-rails-ee-fips, actions-runner, commercial-gitlab-rails-ee, renovate, haraka, prism, gemini-cli, pelias-api...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: saf, npm, py3-captum, kibana, code-server, vitess, node-gyp, commercial-gitlab-rails-ee-fips, actions-runner, commercial-gitlab-rails-ee, renovate, haraka, prism, gemini-cli, pelias-api...
CVE-2026-6733 vulnerabilities
Vulnerabilities for packages: saf, npm, py3-captum, kibana, code-server, vitess, node-gyp, commercial-gitlab-rails-ee-fips, actions-runner, commercial-gitlab-rails-ee, renovate, haraka, prism, gemini-cli, pelias-api...
CVE-2026-6733 vulnerabilities
Vulnerabilities for packages: npm, node-gyp, renovate, code-server, prism, saf, vitess...
GHSA-G8M3-5G58-FQ7M vulnerabilities
Vulnerabilities for packages: npm, node-gyp, renovate, code-server, prism, saf, vitess...
GHSA-P88M-4JFJ-68FV vulnerabilities
Vulnerabilities for packages: npm, node-gyp, renovate, code-server, prism, saf, vitess...
CVE-2026-12151 vulnerabilities
Vulnerabilities for packages: npm, node-gyp, renovate, code-server, prism, saf, vitess...
CVE-2026-11525 vulnerabilities
Vulnerabilities for packages: npm, node-gyp, renovate, code-server, prism, saf, vitess...
CVE-2026-9679 vulnerabilities
Vulnerabilities for packages: npm, node-gyp, renovate, code-server, prism, saf, vitess...
GHSA-VXPW-J846-P89Q vulnerabilities
Vulnerabilities for packages: npm, node-gyp, renovate, code-server, prism, saf, vitess...
Malicious Package
Overview free-anthropic-claude is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
ROOT-APP-NPM-CVE-2025-54798 CVE-2025-54798 in @rootio/tmp - Patched by Root
Root has patched CVE-2025-54798 in the @rootio/tmp package for Root:npm. Multiple fixed versions available...
MAL-2026-6249 Malicious code in blinkit-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8 On npm install, the package's preinstall lifecycle hook runs curl against http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/ and POSTs the installer...
Malicious code in zomato-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1b48a397992964f8f3982dc69a33431bfb26c911c29a1e5d124581cef46a40 Dependency-confusion package targeting an internal Zomato namespace. The package ships only a stub index.js module.exports = name: 'zomato-config',...
MAL-2026-6261 Malicious code in sf-storybook (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a1a34bbf1dc84732509c5c5bfbd65adcd442b2665367d0c1bd39dc8301001c On require'sf-storybook', index.js shells out via childprocess to run cat /etc/passwd ./passwd.txt and then POSTs the file contents via curl to...
Malicious code in atlasora-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7c54cd0923afe13aadf778a5c213363c521e7a50c4b9e235bf6c7cf58a973d On npm install, the package's postinstall hook node install.js, declared in package.json harvests secrets from the installer's machine and POSTs them...
Malicious code in aikaf668897 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 450730a92143c06530923dacda588a17252ebc7edc9ddf71ff520446de5a3293 On npm install, the package's postinstall hook node scripts/postinstall.js spawns a detached background Node process running scripts/shell.js with...
MAL-2026-6217 Malicious code in aikaf788812 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c91950cef6a5f877a4a9bca074501e4c910dc50008d4c8c2623ddc21f08e31f2 Package masquerades as a string-utility library but ships a postinstall backdoor. On npm install, scripts/postinstall.js spawns scripts/shell.js as a...
Malicious code in create-mono-package (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85402ef2db7bfd9e2bb01034a533e52649cf6058cc1e824e9c273aee5ae8121d The package's postinstall hook .prepare.cjs collects host fingerprint data os.hostname, os.userInfo.username, platform/arch, all non-internal network...