GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: pulumi, opensearch-dashboards, kubeflow-centraldashboard, homepage, lerna, code-server, wazuh-dashboard, jupyter-base-notebook, gitlab-rails-ce-fips, kibana, gitlab-rails-ce, npm, wazuh-dashboard-fips, actions-runner, graalvm, prism, opensearch-dashboards-fips, sqlpa...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: pulumi, opensearch-dashboards, tensorflow-gpu-jupyter, kubeflow-centraldashboard, lerna, code-server, wazuh-dashboard, jupyter-base-notebook, gitlab-rails-ce-fips, kibana, gitlab-rails-ce, npm, wazuh-dashboard-fips, actions-runner, graalvm, prism,...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: pulumi, opensearch-dashboards, tensorflow-gpu-jupyter, kubeflow-centraldashboard, homepage, lerna, code-server, wazuh-dashboard, jupyter-base-notebook, gitlab-rails-ce-fips, kibana, gitlab-rails-ce, npm, wazuh-dashboard-fips, actions-runner, graalvm, prism,...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: lerna, code-server, kubeflow-centraldashboard, prism, saf, pulumi, jupyter-base-notebook, npm, sqlpad...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: lerna, code-server, kubeflow-centraldashboard, prism, saf, pulumi, jupyter-base-notebook, npm, sqlpad...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: lerna, code-server, kubeflow-centraldashboard, prism, saf, pulumi, jupyter-base-notebook, npm, sqlpad...

MAL-2026-10968 Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...

MAL-2026-10966 Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...

MAL-2026-10971 Malicious code in cxpw-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2288ef5dfb841556f7ba4907a025270dfda3439820215b7d98e644afca78a306 cxpw-offers ships an empty index.js and declares its only dependency ltidisafe as a direct tarball URL at...

NPM: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

NPM: Axios: HTTP/2 streamed uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.18.0...

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.16...

MAL-2026-10920 Malicious code in alb-lambda-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...

Malicious code in lwc-slds-lbc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...

Malicious code in your-unique-package-name1337 (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10905 Malicious code in win-build-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bd3facc00c36861223058a572fbaa888d815a06c7b309c44639c544c65f1d9 The package name suggests a Windows build helper utility, but no concrete behavioral evidence is available to confirm or refute installer-side risk. ...

Malicious code in solana-web3-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 073f4c1e75630bbf1c535a334f4d7f233a73439240bc22e69bac0e926c8c58a0 Package name closely mirrors the widely-used @solana/web3.js Solana SDK while being published under an unrelated, unscoped name. The bundled...

MAL-2026-10902 Malicious code in solana-web3-patched (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99e6f959c8df3e2933c860ba3d36dc5dbbd27d97a69a3e97a5a7feaf7e24899 Package name 'solana-web3-patched' resembles the legitimate '@solana/web3.js' library and is published as an unscoped lookalike at version 1.0.0. The...

Malicious code in solana-web3-patched (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99e6f959c8df3e2933c860ba3d36dc5dbbd27d97a69a3e97a5a7feaf7e24899 Package name 'solana-web3-patched' resembles the legitimate '@solana/web3.js' library and is published as an unscoped lookalike at version 1.0.0. The...

Malicious code in solana-rpc-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57e3e79e60f9b8ec7f7c9b5199ecab2efaf72566eaed0f358a3b80adad5558d The package's bundled entry points lib/index.cjs.js and lib/index.esm.js co-locate require'childprocess', fetch/POST/GET calls, and references to...

Malicious code in golan125-homepage-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 705b0dc2e3b9aafb6d0e72ecb5ad51d873cd59104a045f74bb27161c87a24960 Package self-identifies as a security research test 'Security research test - do not install'. The package.json homepage field contains...