Security Bulletin: Uninitialized Memory Exposure in node-tar list/t Sync Mode When Tar File Is Modified During Read affect IBM watsonx.data

Summary node-tar is a Tar for Node.js. In 7.5.1, using .t aka .list with sync: true to read tar entry contents returns uninitialized memory contents if tar file was changed on disk to a smaller size while being read. This vulnerability is fixed in 7.5.2. These can affect IBM watsonx.data...

CVE-2026-33066 SiYuan has Stored XSS to RCE via Unsanitized Bazaar README Rendering

SiYuan is a personal knowledge management system. In versions 3.6.0 and below, the backend renderREADME function uses lute.New without calling SetSanitizetrue, allowing raw HTML embedded in Markdown to pass through unmodified. The frontend then assigns the rendered HTML to innerHTML without any...

Malicious code in uipathisfun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4128340804464a33ae1b20bb39d652bf1c658b63490cd97d45df609dabfd8f3f The package uipathisfun was found to contain malicious code. Source: ghsa-malware 5056a460c4d2ea98b9bc0090e9f7e81637ed9860f3b4befb1e8ab11df2248c73 An...

Malicious Package

Overview chai-as-chayn is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1976 Malicious code in innocent-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a43dfe9cc2eebd7f30e81c4d84f86e0375a8f68621f3dd52156c93a9062e67c7 The package innocent-pkg was found to contain malicious code. Source: ghsa-malware e6e3d2128a98a7bfca4b4ef2d91cc684dad0a7386877a5673ecb0911489bbd7a A...

Malicious Package

Overview @get-wrecked/overlay is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1974 Malicious code in @fr3newera/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fba6d334ab723d77261982b048c8728dfdd60454bac47a0c23322ac7251e4c8 The package @fr3newera/baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1979 Malicious code in rollup-plugin-polyfill-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985c6e7bc0975c513137b35a6dca07cf02aa2b87444716244933ca17d56c6bd2 The package rollup-plugin-polyfill-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1944 Malicious code in couplus-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0c78a6293dc26a858801e92b94142c0fb6ab09c558b39900095be8a8aef9a52 The package couplus-cli was found to contain malicious code. Source: ghsa-malware 469c68fc4282e268dbe121670070e4a148ec18adaad72317ca06de47eed59217 An...

MAL-2026-1961 Malicious code in novi-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f8efd6fadd98f176db87625b5ab11bb8c301425b5cac56b3a6e06cea11480e5 The package novi-cli was found to contain malicious code. Source: ghsa-malware 6869c6ff2172bab7034855a5b3343c548e54f977036706052a989d381b471ce5 Any...

MAL-2026-1973 Malicious code in woltpickerapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a6352ffe541b2fd35eb37ebb5dbdc78f1f57a51d31b36c6fcae39d21f97c594 The package woltpickerapp was found to contain malicious code. Source: ghsa-malware b0c8234f6a72b4da77be49eb19f15dc41dd1d94b6b8b9bc4bffd3ef9ddb4316b...

Malicious Package

Overview cryptopapi is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in kyxhiagent123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cbb459239a25561ab1236b8a8a65a78c2a6e4a3d8a1d6108e765bb00f30bc3f The package kyxhiagent123 was found to contain malicious code. Source: ghsa-malware 49504d4323ce1499bf13802068f8105487c66e05b4f7a31f6a2209820ccf08ba...

Malicious code in fadlsjf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7851237c54cc21d98214fdd4c10550fb6665672f78c6f685de666e25f116c54f The package fadlsjf was found to contain malicious code. Source: ghsa-malware 84c2aa35dc6cdbc9581e9c90d31fc8048bf73c56102725c533f82882b2aa3422 Any...

MAL-2026-1948 Malicious code in fadlsjf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7851237c54cc21d98214fdd4c10550fb6665672f78c6f685de666e25f116c54f The package fadlsjf was found to contain malicious code. Source: ghsa-malware 84c2aa35dc6cdbc9581e9c90d31fc8048bf73c56102725c533f82882b2aa3422 Any...

Malicious code in el-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3c49d25d54c1bd3e1e5ba1ab4996329e8244ba30c1639f977985930fafd91f The package el-icon was found to contain malicious code. Source: ghsa-malware a5783aeff6b8639c7ecb526c39e297c96949bead58c8e1aabf1be7417d75e696 Any...

Malicious code in mtpmysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d398ba3dd05ce79a06fb2a2433842d601f917e38ffaa3ad94c02adc1bdb3b67f The package mtpmysql was found to contain malicious code. Source: ghsa-malware 0c3a7ad80c6454678adb0b86352965523e6157aec98c3976686697663fd882e8 Any...

Malicious code in mtpdb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89aa3ea4bbc8f5db5e0f67c215b7d778830cdc3c6182ba672690e1c56165165e The package mtpdb was found to contain malicious code. Source: ghsa-malware 0b9a3a3255445cdf958934371ac3763154e4ff6131d4798401fcb0e13823824a Any...

Malicious code in parsejson-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bee06fce3066f17a6400fc1800b42e5c53eeb9826bb9672cec6ad8ff65306807 The package parsejson-pro was found to contain malicious code. Source: ghsa-malware f2f105fb92bd66d0baadfb4bc605643a2eaff5cd51a4d565f82f61e4c0cb3a71...

MAL-2026-1968 Malicious code in safe-json-parsex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c75827c4ff52be2152687faf186ee7a5668e9dd33bd30adfab490a5e2198c30 The package safe-json-parsex was found to contain malicious code. Source: ghsa-malware 4baa22d0d844650e1fcedcce52b117324903496e0d1399245674b48e4b3ae0...