MAL-2026-10668 Malicious code in chain-as-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f8946bf37a9861239e59a78f2d003612494061d5aa60c5f7e54379e72f0ac7 chain-as-log advertises itself as a chai plugin providing deep-equal-excluding assertion helpers. At plugin load time when a consumer calls...

MAL-2026-10671 Malicious code in spytrack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72113145e88d53764f1e157c91cda05cb143a31802d9565ba8e1765e9886491b spytrack is a typosquat of chai-spies. When the plugin is registered via chai.use, the top-level plugin function invokes assertConnection, which...

Malicious code in @fhkry/x-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f6c3e5c391d9d3ffeb7f6c1b4154b0266efeb73bdf5543ad81f50236bdabc This package presents itself as a fork of @whiskeysockets/baileys impersonating the original author 'Adhiraj Singh' in package.json and exposing the...

Malicious code in true (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e9073206745b049b5e95082a78cf8c0b48f7dc68cdadf1d20be35c0a89aeecb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ROOT-APP-NPM-AIKIDO-2026-10823 AIKIDO-2026-10823 in @rootio/axios - Patched by Root

Root has patched AIKIDO-2026-10823 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

MAL-2026-10658 Malicious code in @sauruslord/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7572befaa64e1e08790af3235ffcc091d379158bf1389c1be9c67d30e3d205a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10657 Malicious code in @sauruslord/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c253865ed8326b20645b4eb66bb0e4bd0445d74ca15fb057ac9839a046e59c9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sauruslord-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 474b90ec19af5dbbc5bf3c8d27c0c4d079c7d980d6e3316dad3bbf5682abbe52 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10634 Malicious code in estore-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5f2a664c7576b3cbf04696ddff717d8b3e9b835693035fa56a23035edef411 package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/d32804ac-1bbb-4100-ab60-95231dd3251c/, sending the...

MAL-2026-10651 Malicious code in iwsdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66af3674e89512532e1448a9421b3318388094ff91bb2e8c32714670a7f5f2cc The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10650 Malicious code in install-skia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b665b508eeae9e0e619ed7b68e3a43248cd81d67d40a0516bbd62981ddb2359f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

CVE-2026-11403

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm NuGet API Key, Docker Bearer Token, or npm Bearer Token must be enabled an...

CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: pulumi, kubeflow-centraldashboard, graalvm, opensearch-dashboards, actions-runner, prism, saf, wazuh-dashboard, npm, sqlpad, wazuh-dashboard-fips, gitlab-rails-ce-fips, kibana, opensearch-dashboards-fips, lerna, code-server, gitlab-rails-ce...

CVE-2026-59873 vulnerabilities

Vulnerabilities for packages: pulumi, kubeflow-centraldashboard, graalvm, opensearch-dashboards, actions-runner, prism, saf, wazuh-dashboard, npm, sqlpad, wazuh-dashboard-fips, gitlab-rails-ce-fips, kibana, opensearch-dashboards-fips, lerna, code-server, homepage, gitlab-rails-ce...

CVE-2026-59874 vulnerabilities

Vulnerabilities for packages: pulumi, kubeflow-centraldashboard, graalvm, opensearch-dashboards, actions-runner, prism, saf, wazuh-dashboard, npm, sqlpad, wazuh-dashboard-fips, gitlab-rails-ce-fips, kibana, opensearch-dashboards-fips, lerna, code-server, homepage, gitlab-rails-ce...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: lerna, kubeflow-centraldashboard, saf, npm, code-server, pulumi, sqlpad, prism...

CVE-2026-59871 vulnerabilities

Vulnerabilities for packages: lerna, kubeflow-centraldashboard, saf, npm, code-server, pulumi, sqlpad, prism...

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...