tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

SUSE CVE-2026-55968

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

Malicious Package

Overview aone-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in aone-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8c02fc6bb23600ab64d77ac8f4d615fcf128010f26df033c40ed2dc2476b9ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lib-mtop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1dad2a69d97f4f14b77fdb334f860745feac703828131718a950a54b2d7cece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aone-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb48e61b0c82bff5ed26f7afb8cfca9248ffe0a256db4bd9fd2e47b757e7784d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11162 Malicious code in aone-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8c02fc6bb23600ab64d77ac8f4d615fcf128010f26df033c40ed2dc2476b9ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11164 Malicious code in aone-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb48e61b0c82bff5ed26f7afb8cfca9248ffe0a256db4bd9fd2e47b757e7784d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cloud-config-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a19fd2daa8759d7f8a31f0b54cffd70e5769e2268a447f8ba0b890006edee17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in smart-config-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c23d349475bd923bd4f57440ddd7c07bbfb8b93b746788ecb4b8cc87e1ebae0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview smart-config-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11169 Malicious code in smart-config-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c23d349475bd923bd4f57440ddd7c07bbfb8b93b746788ecb4b8cc87e1ebae0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

tar: Node-tar: Denial of Service via malformed tar archive header

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop,...

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

CVE-2026-66921

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

CVE-2026-66922

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or proto, were not handled as ordinar...

Malicious code in bianira-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...

MAL-2026-11132 Malicious code in bianira-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a775549df738e414db9982a4695da893427c09ccc63cd520917c1b73476f4336 plugin.js the package main contains an appended top-level IIFE that runs on any require/import of the package. Every network-related identifier...

Malicious code in blots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847ba592915f4561a16225808a93d2428bc12305dc3df0bbf5316bf5a5bd7518 package.json defines preinstall and postinstall lifecycle scripts that unconditionally run curl against a hardcoded webhook.site endpoint, transmitti...

Malicious code in array-node-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0dbd4ffa55ee3a0972b3e5e3fef599244049244d9f996a9d8b809a3a3a53e1a The package's main file index.js is a heavily obfuscated obfuscator.io RC4+base64 string-array module whose top-level IIFE runs on require. It loads...