MAL-2026-10650 Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10651 Malicious code in iwsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview assertion-utils-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-59874 vulnerabilities

Vulnerabilities for packages: sqlpad, code-server, lerna, opensearch-dashboards-fips, opensearch-dashboards, saf, wazuh-dashboard, actions-runner, pulumi, gitlab-rails-ce, kubeflow-centraldashboard, jupyter-base-notebook, graalvm, kibana, wazuh-dashboard-fips, npm, gitlab-rails-ce-fips, prism,...

CVE-2026-59873 vulnerabilities

Vulnerabilities for packages: sqlpad, code-server, lerna, opensearch-dashboards-fips, opensearch-dashboards, saf, wazuh-dashboard, actions-runner, pulumi, gitlab-rails-ce, kubeflow-centraldashboard, jupyter-base-notebook, graalvm, kibana, wazuh-dashboard-fips, npm, gitlab-rails-ce-fips, prism,...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: sqlpad, code-server, lerna, opensearch-dashboards-fips, opensearch-dashboards, saf, wazuh-dashboard, actions-runner, pulumi, gitlab-rails-ce, kubeflow-centraldashboard, jupyter-base-notebook, graalvm, kibana, wazuh-dashboard-fips, npm, gitlab-rails-ce-fips, prism,...

CVE-2026-59871 vulnerabilities

Vulnerabilities for packages: code-server, kubeflow-centraldashboard, lerna, pulumi, prism, jupyter-base-notebook, saf, npm, sqlpad...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: code-server, kubeflow-centraldashboard, lerna, pulumi, prism, jupyter-base-notebook, saf, npm, sqlpad...

Malicious Package

Overview nodemon-plint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

Malicious code in momenntjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aae445dd0b77bd7409820067097404e4ccb16d658e7911c7c4e659146fdfad4 momenntjs is a typosquat of momentjs whose package.json postinstall hook runs node.init.js. On npm install,.init.js enumerates roughly 60...

ROOT-APP-NPM-CVE-2026-8159 CVE-2026-8159 in @rootio/multiparty - Patched by Root

Root has patched CVE-2026-8159 in the @rootio/multiparty package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview @oliviamcdaniel12/safer-buffer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious code in bimi-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo...

M-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions

Detect and mitigate malicious @asyncapi npm packages linked to the latest npm supply chain attack...

Malicious code in @akshajrawat/plugin-repo-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 596ef9a9a6888c00110ee80e3633052ed89887a8465e9a5eaa824a81e5211e46 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview @tonsdk/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview micro-ui-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview relative-time-live is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in sight-bind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398788014436c7e95df3045f9b32398c3de46b8c9275c0437e44bda1dcb6cc00 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...