236333 matches found
Malicious code in thedata (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e05613178114f2f3d9171f429a5b6aba8e1a525e07db22d150be81c02d6f595 The package's main entry index.js re-exports two values, rsaKey and desKey, from apps/docs/app/theta.js, which simply readFileSync's...
MAL-2026-11270 Malicious code in create-backend-scaffold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0201b01c3bd9dbea597956acb10299aa22cd7976dcb7863348892f46512b47f1 playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer aliases require/module to...
ROOT-APP-NPM-GHSA-CMWH-PVXP-8882 GHSA-cmwh-pvxp-8882 in @rootio/dompurify - Patched by Root
Root has patched GHSA-cmwh-pvxp-8882 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-6734 CVE-2026-6734 in @rootio/undici - Patched by Root
Root has patched CVE-2026-6734 in the @rootio/undici package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-9679 CVE-2026-9679 in @rootio/undici - Patched by Root
Root has patched CVE-2026-9679 in the @rootio/undici package for Root:npm. Multiple fixed versions available...
CLEANSTART-2026-CB11602 Security fixes in npm 11.18.0-r0
Package npm version 11.18.0-r0 fixes 1 vulnerabilities: CVE-2026-13149...
CLEANSTART-2026-TH02378 Security fixes in npm 11.14.0-r4
Package npm version 11.14.0-r4 fixes 8 vulnerabilities: ghsa-vxpw-j846-p89q, ghsa-p88m-4jfj-68fv, ghsa-g8m3-5g58-fq7m, ghsa-35p6-xmwp-9g52, CVE-2026-12151...
Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than...
MAL-2026-11177 Malicious code in @peptide-unit/js-unimode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d2db0b951057e42b31006e9bfd3752cde6db494df5959f44e0243f802d7a32 index.js is a repackaged copy of the legitimate emptyport/unimod peptide-modification lookup library with an obfuscator.io RC4 string-array IIFE...
MAL-2026-11178 Malicious code in @peptide-unit/peptide-modify (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...
ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in @rootio/axios - Patched by Root
Root has patched CVE-2026-44489 in the @rootio/axios package for Root:npm. Multiple fixed versions available...
Malicious code in test2221 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...
MAL-2026-11176 Malicious code in @bowozzz/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...
Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan RAT associated with the DEVPOPPER malware family. The list of affected packages is as follows - @joyfill/[email protected] @joyfill/[email protected]...
MAL-2026-11161 Malicious code in @joyfill/layouts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2f0675d4a2717361ec79b2c5a5cbf0ff0367e8d9cbf991f2f300df6c6b819ec Analysis of @joyfill/[email protected] surfaced no a static rule matches and no traced code paths indicating exfiltration, install-time remot...
Malicious code in blots (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847ba592915f4561a16225808a93d2428bc12305dc3df0bbf5316bf5a5bd7518 package.json defines preinstall and postinstall lifecycle scripts that unconditionally run curl against a hardcoded webhook.site endpoint, transmitti...
MAL-2026-11131 Malicious code in basic-vite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab736217e52ecd2e4aa966da6192e434d69f7d34cc5b7a1ce72c6c6ece6aff56 package.json declares preinstall: node index.js, so npm install basic-vite auto-executes index.js. The script collects host identity data hostname,...
MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1 The @yancyyu/agentcli package installs a telemetry worker dist/telemetry-worker.bundle.mjs that is started by agentcli init / agentcli usage start an...
Malicious code in toll_free (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80914891625809e622f8383e3d7f39792cc850a57dba2d68f831ada91cfd5871 package.json defines both preinstall and postinstall lifecycle scripts that run curl against a hardcoded webhook.site endpoint, sending the installer...