GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, code-server, gitlab-rails-ce, opensearch-dashboards, actions-runner, pulumi, wazuh-dashboard-fips, lerna, homepage, opensearch-dashboards-fips, kubeflow-centraldashboard, graalvm, kibana, sqlpad, npm, prism, saf,...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, code-server, gitlab-rails-ce, opensearch-dashboards, actions-runner, pulumi, wazuh-dashboard-fips, lerna, opensearch-dashboards-fips, kubeflow-centraldashboard, graalvm, kibana, sqlpad, npm, prism, tensorflow-gpu-jupyter, saf,...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, code-server, gitlab-rails-ce, opensearch-dashboards, actions-runner, pulumi, wazuh-dashboard-fips, lerna, homepage, opensearch-dashboards-fips, kubeflow-centraldashboard, graalvm, kibana, sqlpad, npm, prism,...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, code-server, gitlab-rails-ce, opensearch-dashboards, actions-runner, pulumi, wazuh-dashboard-fips, lerna, homepage, opensearch-dashboards-fips, kubeflow-centraldashboard, graalvm, kibana, sqlpad, npm, prism,...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: npm, kubeflow-centraldashboard, prism, sqlpad, pulumi, saf, jupyter-base-notebook, code-server, lerna...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: npm, kubeflow-centraldashboard, prism, sqlpad, pulumi, saf, jupyter-base-notebook, code-server, lerna...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: npm, kubeflow-centraldashboard, prism, sqlpad, pulumi, saf, jupyter-base-notebook, code-server, lerna...

Malicious code in react-tabulix-virtual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90c8fc6aca32e28a4faed28ca3f7879cb22e84139b7b09a2a83c5df74259a14 package.json declares scripts.preinstall as node./dist/index.d.js, which runs automatically on npm install. dist/index.d.js contains a base64-encoded...

MAL-2026-10987 Malicious code in react-tabulix-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...

Malicious code in react-tabulix-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...

MAL-2026-10968 Malicious code in commonweb-rewards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 741bb412733dcbcc7aac51796dd6e3b0a6b86439c4886aad1b0418959051d0b3 commonweb-rewards ships an empty index.js and declares a single dependency ltidisafe whose version spec is a direct URL to a tarball on a non-publish...

MAL-2026-10966 Malicious code in commonweb-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45f481316bef278d1accb9df9fb9e30f5789c2c783c749c7f8903868130a71 [email protected] ships an effectively empty main module index.js exports an empty object and its package.json declares a dependency 'ltidisafe'...

Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee7c2ba53e2c7adae6a2b54776c21490794ee8f28fde98f5c61778380de1382 Package [email protected] contains 2 files with no a static rule matches and no traced behavioral findings. The version number 99.9.1 an...

MAL-2026-10967 Malicious code in commonweb-moneymovement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee7c2ba53e2c7adae6a2b54776c21490794ee8f28fde98f5c61778380de1382 Package [email protected] contains 2 files with no a static rule matches and no traced behavioral findings. The version number 99.9.1 an...

MAL-2026-10971 Malicious code in cxpw-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2288ef5dfb841556f7ba4907a025270dfda3439820215b7d98e644afca78a306 cxpw-offers ships an empty index.js and declares its only dependency ltidisafe as a direct tarball URL at...

MAL-2026-10940 Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

NPM: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

NPM: Axios: HTTP/2 streamed uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.18.0...

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups

NPM: brace-expansion: DoS via exponential-time expansion of consecutive non-expanding groups vulnerability discovered by ? in WordPress Npm brace-expansion versions 1.1.16...

Malicious code in s3-lambda-dynamodb-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6517c8914c4ba64ce57809484229df7fbe5dd9f5129c40b19cec8a73c10a70ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in alb-lambda-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...