NPM: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

NPM: re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...

Malicious code in @0xlr/question-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f892cd190720c7c8f07109cfcbdd37f66caf5065ba5667b5be0800813dc0cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @0xlr/supabase-db is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @0xlr/test-callback is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @0xlr/question-types is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11433 Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...

Malicious Package

Overview @sudoughnym/enviro-demo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

MAL-2026-11448 Malicious code in @peptide-packets/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0bc181dc4391ee3b974bfa8ec4aafcf982c6bae5f7d9e6850d03d25293cca6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socketi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f02e02642c533799ed96fac51f973f65097eb5b870dc1a0ea47e2fdcbb70893 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview socktio is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-11334 Malicious code in moontose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d8d632d57584e0320f3bc47ad4d13768be553c24a711c602e7c865be17a614 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vcse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23149b92d10aaf504452f58832dd63804e33639ceda81871c4188295d3d13117 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in socktio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb2387c455cb19ae4c050c6ae6493e1f77af78385fc684ed7bad4c2452b3ad5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in moontose (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d8d632d57584e0320f3bc47ad4d13768be553c24a711c602e7c865be17a614 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview vcse is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in passsport1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68604126507bac849b697119200b6ef37f408aaa077f208ae0127605159a9832 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11241 Malicious code in asdsafsadad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67f3884787706e55b04fcf9ab0749dd3f91bd1f8a9d06bd86180483dd9f581cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rlp.git (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 684e2df8545256deec1b035965a2f37977d95033aef05d1ad736577d91a04bed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fc78fcfb574c958db27a4d94c79bd1ae87c3d5790fdcc044e47f2f97980cfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6432be2aefc6715127bc533a383c361b15420316f144dccfc98f1dd4c7d36f06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...