Malicious Package

Overview dakumangalsingh is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vczxijghsvizu4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dzvchorehui2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.15) +23 more potentially affected by CVE-2026-53496 via exifreader (>=4.1.1, <=4.39.1)

exifreader NPM version =4.1.1, =0.0.5, =1.18.1-dev.1638815480459, =1.0.2, =2.2.8, =2.1.11, =1.0.6, =0.5.0, =4.10.0, =1.0.0-beta.141, =1.0.0-beta.143 - @scopieflows/app-image-helper 0.1.12 and more Source cves: CVE-2026-53496 Source advisory: SNYK:JS-EXIFREADER-18016336...

@grackle-ai/cli (>=0.107.2, <=0.132.1), @grackle-ai/plugin-orchestration (>=0.97.0, <=0.132.1) +1 more potentially affected by unknown CVE via @grackle-ai/plugin-core (>=0.97.0, <=0.132.1)

@grackle-ai/plugin-core NPM version =0.97.0, =0.107.2, =0.97.0, =0.107.2, =0.132.1 Source cves: unknown CVE Source advisory: OSV:GHSA-F9FF-5X35-7GFW...

Protection Mechanism Failure

Overview praisonai is a PraisonAI TypeScript AI Agents Framework - Node.js, npm, and Javascript AI Agents Framework Affected versions of this package are vulnerable to Protection Mechanism Failure through the SandboxExecutor process in network-isolated mode, which fails to enforce true network...

@alok5953/videoextract (>=1.0.0, <=1.0.7), @aspects-ai/workspace-cli (>=0.1.17, <=0.1.24) +44 more potentially affected by CVE-2026-30121 via @remotion/studio (>=4.0.81, <=4.0.409)

@remotion/studio NPM version =4.0.81, =1.0.0, =0.1.17, =0.1.38, =1.0.0, =1.0.0, =0.1.4, =0.1.3, =0.1.4, =0.1.0, =3.0.4, =4.0.90, =4.0.81, =4.0.81, =4.0.81, =4.0.409 and more Source cves: CVE-2026-30121 Source advisory: SNYK:JS-REMOTIONSTUDIO-17817235...

@karakeep/mcp (>=0.23.3, <=0.31.0) potentially affected by unknown CVE via @karakeep/sdk (>=0.23.2, <=0.31.0)

@karakeep/sdk NPM version =0.23.2, =0.23.3, =0.31.0 Source cves: unknown CVE Source advisory: SNYK:JS-KARAKEEPSDK-17739013...

@chrysb/alphaclaw (>=0.8.8, <=0.9.0) potentially affected by CVE-2026-43532 via openclaw (2026.4.9)

openclaw NPM version 2026.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - @chrysb/alphaclaw =0.8.8, =0.9.0 Source cves: CVE-2026-43532 Source advisory: SNYK:JS-OPENCLAW-16109686...

@kyuda/n8n-nodes-databricks (>=2.0.0, <=2.0.6), @kyuda/n8n-nodes-databricks-simplified (1.0.0) +19 more potentially affected by CVE-2025-68613 +1 more via n8n-workflow (>=2.0.0, <=2.9.0)

n8n-workflow NPM version =2.0.0, =2.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.9.0 and more Source cves: CVE-2025-68613, CVE-2026-27577 Source advisory: SNYK:JS-N8NWORKFLOW-15357609...

GHSA-JQPQ-MGVM-F9R6 OpenClaw: Command hijacking via unsafe PATH handling (bootstrapping + node-host PATH overrides)

Command hijacking via PATH handling Discovered: 2026-02-04 Reporter: @akhmittra Summary OpenClaw previously accepted untrusted PATH sources in limited situations. In affected versions, this could cause OpenClaw to resolve and execute an unintended binary "command hijacking" when running host...

@n8n/backend-test-utils (0.26.0), @n8n/db (0.34.0) +2 more potentially affected by CVE-2026-25051 via n8n-core (1.122.0)

n8n-core NPM version 1.122.0 is affected by a known vulnerability. The following packages have a transitive dependency on n8n-core and may be impacted: - @n8n/backend-test-utils 0.26.0 - @n8n/db 0.34.0 - @n8n/task-runner 1.59.0 - n8n-node-dev 1.121.0 Source cves: CVE-2026-25051 Source advisory:...

Malicious code in less-loader-spectron-exoplanetology-phenomic (npm)

The package less-loader-spectron-exoplanetology-phenomic was found to contain malicious code...

MAL-2025-26807 Malicious code in mp3-file-zip-d-ownload-37823-billys-live-bait-gqddl-gymxld (npm)

The package mp3-file-zip-d-ownload-37823-billys-live-bait-gqddl-gymxld was found to contain malicious code...

@oconva/qvikchat (>=1.0.0, <=2.0.0-alpha.4), genkit-intro (1.0.0) +3 more potentially affected by unknown CVE via @genkit-ai/firebase (0.5.17)

@genkit-ai/firebase NPM version 0.5.17 is affected by a known vulnerability. The following packages have a transitive dependency on @genkit-ai/firebase and may be impacted: - @oconva/qvikchat =1.0.0, =0.0.1, =1.0.0 Source cves: unknown CVE Source advisory: SNYK:JS-GENKITAIFIREBASE-12671227...

@redwoodjs/auth-dbauth-setup (0.0.2), @redwoodjs/auth-providers-setup (0.0.1) +12 more potentially affected by unknown CVE via @redwoodjs/api (>=3.0.0, <=3.3.0)

@redwoodjs/api NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.3.0 Source cves: unknown CVE Source advisory: OSV:GHSA-3QMC-2R76-4RQP...

@codingsh/harmony-crypto (>=0.1.57, <=0.1.58) potentially affected by unknown CVE via scrypt-shim (0.0.1-security)

scrypt-shim NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on scrypt-shim and may be impacted: - @codingsh/harmony-crypto =0.1.57, =0.1.58 Source cves: unknown CVE Source advisory: OSV:MAL-2022-5972...

@ieremeev/app (>=3.0.1, <=4.1.1), @meetup/swarm-docs (0.7.10-beta.0) +7 more potentially affected by unknown CVE via serve (>=10.0.0, <=10.1.1)

serve NPM version =10.0.0, =3.0.1, =0.1.0, =0.0.12, =0.0.0, =0.0.10, =0.0.1, =0.0.10 Source cves: unknown CVE Source advisory: OSV:GHSA-48GC-5J93-5CFQ...

ECDSA signature vulnerability of Minerva timing attack in jsrsasign

Impact ECDSA side-channel attack named Minerava have been found and it was found that it affects to jsrsasign. Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits ...

Fedora 30 : nodejs-handlebars (2019-c1213f866c)

Security fix for https://www.npmjs.com/advisories/755 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...