MAL-2026-1247 Malicious code in @imhuman/corp-build-utils-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6184a6191df94d0d85ce593a41435ea200b954b17ce7a90c83cd1fb6ec5453db The package @imhuman/corp-build-utils-poc was found to contain malicious code. Source: ghsa-malware...

Malicious code in @imhuman/fw-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21f635d2d8fbbcc0d1422e1b08e8b71b8efd04e68216dc4eb8ffaec0208f967 The package @imhuman/fw-logger was found to contain malicious code. Source: ghsa-malware...

Malicious code in imhuman-fw-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a81e9c61dcf38b54d4e0ad070050a4817a509858f0f56725074b54c24288a1 The package imhuman-fw-logger was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1249 Malicious code in imhuman-fw-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a81e9c61dcf38b54d4e0ad070050a4817a509858f0f56725074b54c24288a1 The package imhuman-fw-logger was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1248 Malicious code in @imhuman/fw-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21f635d2d8fbbcc0d1422e1b08e8b71b8efd04e68216dc4eb8ffaec0208f967 The package @imhuman/fw-logger was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1253 Malicious code in pear-apps-utils-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65df5bee974b55dfd58d5816e480664604e9d8b3bf6a7c27c22b92aefeaca124 The package pear-apps-utils-date was found to contain malicious code. Source: ghsa-malware...

Malicious code in pear-apps-utils-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65df5bee974b55dfd58d5816e480664604e9d8b3bf6a7c27c22b92aefeaca124 The package pear-apps-utils-date was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview pear-apps-utils-date is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1254 Malicious code in pear-apps-utils-qr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8bf18757dd3797d845e6746f010e38421985192e8623264615f68c13b4ec0a1 The package pear-apps-utils-qr was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1255 Malicious code in pearpass-lib-data-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd09913040448b75ce4023605c2191efccf04f01c8e894d4044e8ee3a04fa67c The package pearpass-lib-data-export was found to contain malicious code. Source: ghsa-malware...

Malicious code in pearpass-lib-data-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd09913040448b75ce4023605c2191efccf04f01c8e894d4044e8ee3a04fa67c The package pearpass-lib-data-export was found to contain malicious code. Source: ghsa-malware...

Malicious code in pear-apps-lib-feedback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 331d2742dee8271e5d493e475aab23ee3f05adc5e02888d87127d189883cc50c The package pear-apps-lib-feedback was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview nf-referral-backend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1244 Malicious code in spectral-corsair-navigator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4faab7d9e9e24067cf0a0ef23c529b2622cbb91b654a35430742ec584b827a54 The package spectral-corsair-navigator was found to contain malicious code. Source: ghsa-malware...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.4 security update

Important: Red Hat OpenShift GitOps v1.18.4 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-8439 CVE-2025-12816 openshift-gitops-1/console-plugin-rhel8: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic...

tar has Hardlink Path Traversal via Drive-Relative Linkpath

Summary tar npm can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Details The extraction logic in UnpackSTRIPABSOLUTEPATH chec...

Permissive List of Allowed Inputs

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via the processing of the mkdocs.yml configuration file...

@backstage/plugin-search-backend-module-techdocs (>=0.4.11-next.0, <=0.4.11-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.2) +1 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.13.11-next.0, <=1.14.2-next.1)

@backstage/plugin-techdocs-node NPM version =1.13.11-next.0, =0.4.11-next.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.1 Source cves: CVE-2026-29186 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-15426449...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.11-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.5-next.2) +2 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.2-next.1)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.5-next.1 Source cves: CVE-2026-29186 Source advisory: OSV:GHSA-928R-FM4V-MVRW...

Important: nodejs22

Issue Overview: A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be...