GHSA-35P6-XMWP-9G52 vulnerabilities

Vulnerabilities for packages: npm, py3-captum, gemini-cli, pelias-api, node-gyp, prism, vitess, renovate, kibana, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, actions-runner, code-server, saf, haraka...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: npm, py3-captum, gemini-cli, pelias-api, node-gyp, prism, vitess, renovate, kibana, commercial-gitlab-rails-ee, commercial-gitlab-rails-ee-fips, actions-runner, code-server, saf, haraka...

MAL-2026-6278 Malicious code in ts-wross (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dae43b7ff77748f10ae5faf6d87b7d63552e5629a37c931ea2c0de3539b469 Package is published under the name ts-wross but its package.json claims authorship by Michael Mclaughlin [email protected] and points its repository...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, code-server, saf, npm, vitess...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, code-server, saf, npm, vitess...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, code-server, saf, npm, vitess...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, code-server, saf, npm, vitess...

GHSA-VXPW-J846-P89Q vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, code-server, saf, npm, vitess...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, code-server, saf, npm, vitess...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: prism, renovate, node-gyp, code-server, saf, npm, vitess...

Malicious Package

Overview free-anthropic-claude is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @nullzero/urlcat (npm)

@nullzero/urlcat version 1.4.2, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accounts all follow the pattern [email protected], with...

Malicious code in forge-jsx4 (npm)

forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...

MAL-2026-6305 Malicious code in @frostnode/waitfor (npm)

@frostnode/waitfor malicious versions 0.9.0, 0.10.3, 0.10.4, and 0.10.5, published by [email protected] is a trojanized npm package belonging to the wshu.net credential-stealer campaign. The campaign published trojanized look-alike utility packages across 12+ scopes whose publisher accoun...

Malicious code in @dexwilt/node-fetch (npm)

The @dexwilt/node-fetch package impersonates the legitimate node-fetch project: its package metadata copies the upstream repository, author, and homepage while publishing under an unrelated scope. Its CommonJS entry point lib/index.js contains the expected node-fetch implementation followed by...

ROOT-APP-NPM-CVE-2025-54798 CVE-2025-54798 in @rootio/tmp - Patched by Root

Root has patched CVE-2025-54798 in the @rootio/tmp package for Root:npm. Multiple fixed versions available...

MAL-2026-6249 Malicious code in blinkit-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ca70b0a6be36daf245deb50dd6b3595a9bfba29c62770e82365152a02832cf8 On npm install, the package's preinstall lifecycle hook runs curl against http://d8s0b82plbq3u5sb2vo0sb3a9obr4yjt7.oast.site/ and POSTs the installer...

MAL-2026-6254 Malicious code in zomato-sushi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f631d7af366bbb607f9088550a64939e395d0ce1199777828269de5772d860c package.json declares a preinstall script that runs curl with form-encoded fields carrying the installer's hostname hostname -f, whoami, current...

Malicious code in zomato-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1b48a397992964f8f3982dc69a33431bfb26c911c29a1e5d124581cef46a40 Dependency-confusion package targeting an internal Zomato namespace. The package ships only a stub index.js module.exports = name: 'zomato-config',...

MAL-2026-6261 Malicious code in sf-storybook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a1a34bbf1dc84732509c5c5bfbd65adcd442b2665367d0c1bd39dc8301001c On require'sf-storybook', index.js shells out via childprocess to run cat /etc/passwd ./passwd.txt and then POSTs the file contents via curl to...