236333 matches found
Malicious code in vectormark (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0646473c841676e2f55d66494a805943e00b2e2d7515e1bbba5453e6a9024e [email protected] advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function getPlugin that issues an...
Malicious code in react-tabulix-extended (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8df06223a5059cf4892135df7f8144e8857ad8c4dbf66d358691597badc36a package.json declares preinstall: node./dist/index.d.js, which fires automatically on npm install. The script contains a base64-encoded payload that...
MAL-2026-10983 Malicious code in svelte-streaks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de19bce1fef8c7cc16b9066720070e2181816e07551ecd8435baea09c607ed6 Analysis of [email protected] surfaced no a static rule matches and no traced behaviors indicative of credential theft, install-time code executio...
Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
MAL-2026-10979 Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
MAL-2026-10984 Malicious code in veskra (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
GHSA-W8WR-V893-VJVP vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, kibana, code-server, npm, opensearch-dashboards-fips, gitlab-rails-ce, graalvm, homepage, kubeflow-centraldashboard, prism, saf, gitlab-rails-ce-fips, sqlpad, pulumi, actions-runner, opensearch-dashboards, lerna...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, kibana, code-server, npm, opensearch-dashboards-fips, gitlab-rails-ce, graalvm, homepage, kubeflow-centraldashboard, prism, saf, gitlab-rails-ce-fips, sqlpad, pulumi, actions-runner, opensearch-dashboards, lerna...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, kibana, code-server, npm, opensearch-dashboards-fips, gitlab-rails-ce, graalvm, kubeflow-centraldashboard, prism, saf, gitlab-rails-ce-fips, sqlpad, pulumi, actions-runner, opensearch-dashboards, lerna...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, wazuh-dashboard-fips, kibana, code-server, npm, opensearch-dashboards-fips, gitlab-rails-ce, graalvm, homepage, kubeflow-centraldashboard, prism, saf, gitlab-rails-ce-fips, sqlpad, pulumi, actions-runner, opensearch-dashboards, lerna...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: npm, kubeflow-centraldashboard, lerna, code-server, saf, sqlpad, pulumi, prism...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: npm, kubeflow-centraldashboard, lerna, code-server, saf, sqlpad, pulumi, prism...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: npm, kubeflow-centraldashboard, lerna, code-server, saf, sqlpad, pulumi, prism...
Malicious code in react-tabulix-virtual (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90c8fc6aca32e28a4faed28ca3f7879cb22e84139b7b09a2a83c5df74259a14 package.json declares scripts.preinstall as node./dist/index.d.js, which runs automatically on npm install. dist/index.d.js contains a base64-encoded...
Malicious code in react-tabulix-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...
MAL-2026-10987 Malicious code in react-tabulix-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4338419bb73e69db7de001f3d27b86c8890a0ba3ace3bfa60e09552d1be3ad9c [email protected] declares a preinstall lifecycle hook that runs dist/index.d.js. That file base64-decodes an embedded blob and passes the...
ROOT-APP-NPM-AIKIDO-2026-10843 AIKIDO-2026-10843 in @rootio/vm2 - Patched by Root
Root has patched AIKIDO-2026-10843 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...