Malicious code in @kl-starfish/test-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b554249a85dcce61ed69ed5552bd6486b14a3ab2d72b7b243638a8ea24a8339 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-15274

A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affects an unknown part of the file src/pullparser/v7400/parser.rs of the component Node Header Handler. The manipulation results in denial of service. The attack must be initiated from a local position. The exploit is now public an...

CVE-2026-59875

A flaw was found in node-tar, a library for manipulating tar archives in Node.js. A remote attacker could craft a malicious archive containing null characters NUL bytes in its metadata. When this archive is processed, the unstripped null characters can cause the application to terminate...

CVE-2026-15274 lo48576 fbxcel Node Header parser.rs denial of service

A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affects an unknown part of the file src/pullparser/v7400/parser.rs of the component Node Header Handler. The manipulation results in denial of service. The attack must be initiated from a local position. The exploit is now public an...

CVE-2026-15274

A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affects an unknown part of the file src/pullparser/v7400/parser.rs of the component Node Header Handler. The manipulation results in denial of service. The attack must be initiated from a local position. The exploit is now public an...

CVE-2026-15274 lo48576 fbxcel Node Header parser.rs denial of service

A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affects an unknown part of the file src/pullparser/v7400/parser.rs of the component Node Header Handler. The manipulation results in denial of service. The attack must be initiated from a local position. The exploit is now public an...

CVE-2026-15274 lo48576 fbxcel Node Header parser.rs denial of service

A vulnerability was detected in lo48576 fbxcel up to 0.9.0. This affects an unknown part of the file src/pullparser/v7400/parser.rs of the component Node Header Handler. The manipulation results in denial of service. The attack must be initiated from a local position. The exploit is now public an...

CVE-2026-15274

Summary of CVE-2026-15274 (lo48576 fbxcel) : Affects the product line lo48576 fbxcel up to version 0.9.0. The issue targets an unknown part of the Node Header Handler, specifically the file src/pull_parser/v7400/parser.rs, where manipulation leads to a Denial of Service. Access is required from a...

CVE-2026-59873

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

CVE-2026-59871

A flaw was found in node-tar, a library for manipulating tar archives in Node.js. This vulnerability occurs when the library incorrectly converts specific archive path values into numbers, leading to an error during subsequent path processing. An attacker could exploit this to cause the applicati...

CVE-2026-53655

A flaw was found in node-tar. This vulnerability arises because node-tar incorrectly applies PAX extended header size records to subsequent intermediary metadata headers, leading to a desynchronization of the tar stream cursor compared to other standard tar implementations. A remote attacker coul...

CVE-2026-59209

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and...

MAL-2026-10082 Malicious code in chain-async-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54cd392461a3d805dd24f6bc67d354498531f9b42352e8e0c17205351dcccf0b The package presents itself as a pino-compatible logger lib/ directory mirrors pino's internal file layout — proto.js, levels.js, redaction.js,...

MAL-2026-10088 Malicious code in lovable-tager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f100c9dbac6f2e352e559d0eb06f573e971845cc083b80c61f211013e03973a lovable-tager is a single-character-deletion typosquat of the legitimate Vite plugin lovable-tagger. The ESM entry dist/index.js referenced by main...

MAL-2026-10087 Malicious code in eslint-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbc3baf80e31e8027d7bb5b3fe5a873c5ff72d8344d39f8f01e191699a2310d7 Package declares postinstall: node lib/utils/index.js, which spawns a detached, stdio-suppressed Node child spawn with detached:true, stdio:'ignore',...

PYSEC-2026-3138 Memory leak in Tensorflow

Impact If a graph node is invalid, TensorFlow can leak memory in the implementation of ImmutableExecutorState::Initialize: cc Status s = params.createkerneln-properties, &item-kernel; if !s.ok item-kernel = nullptr; s = AttachDefs, n; return s; Here, we set item-kernel to nullptr but it is a simp...

Malicious code in nonenull1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 162cd9e0496d35e0500fe084f6011a3e6893182b0fa209502c5d6017ab1138ac The package declares gypfile: true with no native C/C++ sources, and its binding.gyp abuses GYP command-expansion syntax in the sources list — !node...

MAL-2026-10063 Malicious code in express-router-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49091d8e8923e3e709cebd14f01ee1617267bf3f9b6be99052603715b7cf9f70 The sole shipped file index.js is a heavily obfuscated RC4 + base64 string-array, 337-entry rotated array, control-flow flattening IIFE that executes...

Malicious code in type-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b5cd26e040f4f4366ed65cca4b70258d276f781e0aab76b99b5573d4007a97d The npm package [email protected] masquerades as the pino logger copied module layout, exports as module.exports.pino, keywords fast/logger/stream/jso...

MAL-2026-10066 Malicious code in nps-retrieval-diagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9521917c225941dd1bfc038c4f324d24ebb9d99b99596e8a481558da10a0df The package's bin entry retrieval-diagnostics installs an attacker-controlled persistence footprint on the host when invoked. It appends a crontab...