MAL-2026-10158 Malicious code in notify-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25536516e16cffdc7ad2891886d7dcf32ad325b9ba79c2359026809bcfbf417f Package published as notify-utilities masquerades as the pino logger package.json description, keywords, and index.d.ts are copied from pino; the...

MAL-2026-10156 Malicious code in notify-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fec337f1c1858ad605f875ea51feb09f84fbd2eb702c7bc0462dbb427b3eff05 [email protected] presents itself as the pino logger export name pino, README and type definitions mimic pino, npm version badge points at the...

MAL-2026-10157 Malicious code in notify-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9cbb2ac45124e3844e29f3efd70ca26f0089ec4eaad718bcbdaf3035ec9b34b The package impersonates the pino logger API exports module.exports.pino = middleware, ships pino-style files such as lib/proto.js, lib/multistream.j...

MAL-2026-10154 Malicious code in notify-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf89f8fbe4c3f9ae9494077688977f46c8b3f875a552054508ac5eec7b62344 notify-dist advertises itself as a pino-compatible logger/middleware exports module.exports.pino, keywords fast/logger/stream/json, lib/ mirrors pino...

MAL-2026-10145 Malicious code in motiondnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 11d8d84a54d776c1b4d6b53bdb39c8b181d9bfde03da128c7b3f58d6fb631284 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in theta-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967c021e95228b33b18be4489fea5d404720cbd21beb53dac8bf7ea4f4d54d1 [email protected] ships src/decrypt.js and src/providers/BaseProvider.js which together implement a hidden execution channel. On module load,...

MAL-2026-10135 Malicious code in theta-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967c021e95228b33b18be4489fea5d404720cbd21beb53dac8bf7ea4f4d54d1 [email protected] ships src/decrypt.js and src/providers/BaseProvider.js which together implement a hidden execution channel. On module load,...

Malicious code in polygon-gama-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e5efa9d57dae04a6082dfa776d2c2664f3ce5a838ed9cf56f40656937b7e92 polygon-gama-apis exports getPlugin, which fetches JSON from https://bet.slotgambit.com/icons/111 and passes the response field data.credits directly...

MAL-2026-10144 Malicious code in mdb-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24ffe7ac6e64aab50d9ba84f5b06ffd1047663698d25071770749b36afe6543 The package's default export getPlugin performs an HTTPS fetch to https://svganchordev.net/icons/107 with URL components split across protocol, domai...

MAL-2026-10147 Malicious code in polygon-gama-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e5efa9d57dae04a6082dfa776d2c2664f3ce5a838ed9cf56f40656937b7e92 polygon-gama-apis exports getPlugin, which fetches JSON from https://bet.slotgambit.com/icons/111 and passes the response field data.credits directly...

MAL-2026-10148 Malicious code in polygon-gamma-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49bd3ddb3340e0ef3c76465b6e275d45ddc8eecdbd742747acde8588a2018b4 [email protected] advertises itself as a 'TypeScript SDK for the Polymarket CLOB API' but ships no Polymarket API surface. The exported...

Malicious code in uac-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2f1cf2dbbdb87f2b0c37826d8326ff0ca7ecfdbc3af1dd4fdd31a0c299c78b [email protected] is an analytics package that, on install, silently mutates the installer's project files: postinstall.js invokes integrate which...

Malicious code in eth-react-redirection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbd414dae34760c2eda09d2093a62a14d694f759350676e88229319a16594e78 On require, index.js calls callCallerAsOrigin which spawns lib/caller.js as a detached, stdio-ignored child process spawnprocess.execPath, script,...

Malicious code in type-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37979cc60cff25e26406f3426f0dd7aeac12c13e55402c89f78228080cac0ad9 The package advertises itself as a pino-style logger but its exported middleware spawns lib/caller.js as a detached Node child process. lib/caller.js...

CVE-2026-56354

n8n before 1.123.24, 2.10.4, and 2.12.0 across its 1.x and 2.x branches contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions...

CVE-2026-56354

CVE-2026-56354 affects n8n before 1.123.24, 2.10.4, and 2.12.0 (1.x and 2.x branches). The Form Node contains cross-site scripting and open redirect vulnerabilities caused by unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creat...

CVE-2026-56354 n8n - Cross-Site Scripting and Open Redirect in Form Node

n8n before 1.123.24, 2.10.4, and 2.12.0 across its 1.x and 2.x branches contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions...

EUVD-2026-42887

n8n before 1.123.24, 2.10.4, and 2.12.0 across its 1.x and 2.x branches contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions...

CVE-2026-56354 n8n - Cross-Site Scripting and Open Redirect in Form Node

n8n before 1.123.24, 2.10.4, and 2.12.0 across its 1.x and 2.x branches contains cross-site scripting and open redirect vulnerabilities in the Form Node due to unsanitized HTML description fields and overly permissive iframe sandbox policies. Authenticated users with workflow creation permissions...

MAL-2026-10124 Malicious code in dowload_ebok_river_of_time_by_naomi_judd_marcia_wilkie_i1ze3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d49a62357bce8bee4379425fb0da49361a417e54e93334e5fd59a7b9601e61e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...