Malicious code in @the-coca-cola-company/receipt-scanner-admin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 046b5475599d30f293f2eeb7ab9fce35c44cd678ab2cecde2c96e588a170d822 The package @the-coca-cola-company/receipt-scanner-admin-lib was found to contain malicious code...

Malicious code in @tax-taxdev/tools-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37c3192cab77322b1ecf1742c4eda9aa9e5a6b495e3bf386284a15cf36365dcc The package @tax-taxdev/tools-scripts was found to contain malicious code...

MAL-2026-2717 Malicious code in @tax-taxdev/tools-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37c3192cab77322b1ecf1742c4eda9aa9e5a6b495e3bf386284a15cf36365dcc The package @tax-taxdev/tools-scripts was found to contain malicious code...

MAL-2026-2715 Malicious code in @mesh-atoms/typography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec6ac39821bf7c99a476b848fcfccf47089487d33dc8eeb893b9f87e6dc7f847 The package @mesh-atoms/typography was found to contain malicious code...

Malicious code in @mesh-atoms/typography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec6ac39821bf7c99a476b848fcfccf47089487d33dc8eeb893b9f87e6dc7f847 The package @mesh-atoms/typography was found to contain malicious code...

MAL-2026-2714 Malicious code in @gameforge/http-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5c80f200c1cbaa194dfc83e5a8c911c182ff110b7451512013646d9414429b4 The package @gameforge/http-server was found to contain malicious code...

MAL-2026-2713 Malicious code in @fuego-tools/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b13e975286ea5f50f12e176e5b9399e209b890fc03e8d5f890f02d83a52489 The package @fuego-tools/analytics was found to contain malicious code...

MAL-2026-2712 Malicious code in @evoja-web/redaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b4a72b65f3b4cc6345a711aad3f9282d9ec77958341be6861f2b355ff3f976 The package @evoja-web/redaction was found to contain malicious code...

Malicious code in @evoja-web/redaction (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b4a72b65f3b4cc6345a711aad3f9282d9ec77958341be6861f2b355ff3f976 The package @evoja-web/redaction was found to contain malicious code...

Malicious code in @evoja-web/react-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5a150d97bdfc04cfc9e3ce56a7d6238d57f578628802fa568ea6404b5463070 The package @evoja-web/react-login was found to contain malicious code...

Malicious code in @appleseed-apple/ac-sass-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c09c442c9bf5d1d38099a4ea05b85daf5b071a2d9e6e87dc72d030ecd4ca5404 The package @appleseed-apple/ac-sass-kit was found to contain malicious code...

Malicious code in @3stripes/toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4529c8ef3e0953799338bc7e0cc7d6ce4f1d8797b3e0984d362ebd26df6bec1c The package @3stripes/toolkit was found to contain malicious code...

Malicious code in @3stripes/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ca39203b484afe25fca27596d3c3c81a0a6765ad88d3b129871375127bdb5ea The package @3stripes/shared was found to contain malicious code...

MAL-2026-2703 Malicious code in @3stripes/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ba4725ff03b9b0a4645734fca9af46fbd145e147f7fb7ee0942853c425f53f The package @3stripes/components was found to contain malicious code...

Node.js: Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames

Vulnerability description not provided...

Improper Verification Of Cryptographic Signature

node-forge is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to insufficient validation of RSASSA PKCS1 v1.5 signatures allowing malformed ASN structures and inadequate padding checks, which allows an attacker to forge valid signatures and bypass signatur...

CLEANSTART-2026-KS09647 Axios is a promise based HTTP client for the browser and Node

Multiple security vulnerabilities affect the mongosh package. Axios is a promise based HTTP client for the browser and Node. See references for individual vulnerability details...

Malicious code in terminal-formatter (npm)

terminal-formatter is a malicious npm package that when installed postinstall-hook or imported sends local env variables, files and bash history to https://ghostraper.top and registers a new ssh key in .ssh/authorizedkeys. --- -= Per source details. Do not edit below this line.=- Source:...

PT-2026-34733

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.0 Description Flowise is a drag and drop user interface for building customized large language model flows. An unauthenticated remote command execution issue exists where a parameter override bypass can be achieve...

RockyLinux 8 : nodejs:20 (RLSA-2026:8339)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:8339 advisory. minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-26996 minimatch: Minimatch: Denial of Service via catastrophic...