MAL-2026-1367 Malicious code in @kinggupong/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c19c128fca5c3aacdbc42a4005ff6e5fac66da9fb811bf98788503f6dfd00eb The package @kinggupong/libsignal-node was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview @kinggupong/baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview unibody is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview praxis-scripts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in pcl-build-docroot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec644efff0c2f83a615a174be4d854af6d4411fec2fd2246ce43b6118f6065fd The package pcl-build-docroot was found to contain malicious code. Source: ghsa-malware...

Malicious code in praxis-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f147ac7e867b493ef159ddfdd294c57a1bfbbd8e502037178470c37345ca0628 The package praxis-scripts was found to contain malicious code. Source: ghsa-malware 9cf02a0374cd88b4ae46f34a484f0441ea2bfaf3c6799812ea6b4cf4e916cd0c...

Malicious Package

Overview pcl-build-docroot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1362 Malicious code in praxis-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f147ac7e867b493ef159ddfdd294c57a1bfbbd8e502037178470c37345ca0628 The package praxis-scripts was found to contain malicious code. Source: ghsa-malware 9cf02a0374cd88b4ae46f34a484f0441ea2bfaf3c6799812ea6b4cf4e916cd0c...

Malicious code in libsignal-mod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 211e000c840d09f14adc470cd83c124e8a4e49249e78c8a759693e3678c63da2 The package libsignal-mod was found to contain malicious code. Source: ghsa-malware bb9ca486dd8fcc83473d13eb8fd8c5f8881d2be2d8301a167de2d40ad8513c51...

Malicious code in @dappaoffc/baileys-mod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee2d90dce9a6d45cb24a57cb738764c3675c7b5e6a594a15f8130938bcf5a886 The package @dappaoffc/baileys-mod was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview @dappaoffc/baileys-mod is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in @dappaoffc/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb37d2f85c635986dff2f78d2a601e36c3f676c4c1a9f65df33c5601a9d7a2ef The package @dappaoffc/baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1363 Malicious code in react-svg-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e014ccf1aaf52a0f5ad92a977b2fb987b63be3ae7bdf8fa9b5f8813f68040344 The package react-svg-anchor was found to contain malicious code. Source: ghsa-malware d539493dcc209d4d478ffa4a5893cd5cd01ee1d994700b9492b651c8aeb372...

MAL-2026-1360 Malicious code in npm-doc-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e02a5339e3c7017ad72be2bb9ed62f13b6d4aeef3450ada18af95a6203e8e105 The package npm-doc-build was found to contain malicious code. Source: ghsa-malware de3094bb10170209a4225724c5cc0934cbc551bbcf01dd6f6df0205ca158ee6a...

MAL-2026-1356 Malicious code in b2b-common-cb-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0699be4242e2a015c76aad1b5ee1f2482f01a59017778511108ed33b8729a8e The package b2b-common-cb-lib was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview b2b-common-cb-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview svg-safety-tool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in restrict-imports (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f82360676317e6d9c2b69a82034af73f2008890871348fb45bc5b966f6aca03c The package restrict-imports was found to contain malicious code. Source: ghsa-malware e153e68a84a468be42de7a7c49af2d4e73778f4462d854be60a6e8baf03105...

GHSA-GMQ8-994R-JV83 yauzl contains an off-by-one error

yauzl aka Yet Another Unzip Library version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate function. The while loop condition checks cursor data.length + 4 instead of cursor + 4 = data.length, allowing readUInt16LE to rea...

CVE-2026-3966

CVE-2026-3966 affects the 648540858 wvp-GB28181-pro package up to version 2.7.4-20260107. The issue lies in the getDownloadFilePath function of ABLMediaNodeServerService.java under the IP Address Handler; manipulating the MediaServer.streamIp argument triggers server-side request forgery (SSRF). ...