Malicious code in @cloudplatform-single-spa/ml-ai-agents-system-prompt (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

MAL-2026-4867 Malicious code in @car-loans/deal-aff (npm)

Part of a dependency confusion attack campaign targeting the @car-loans, @fb-deposit, and @debit-ib npm scopes. The attacker npm user pik-libs published 25 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version resolution,...

@budibase/client (>=3.0.0, <=3.2.26), @budibase/server (>=3.0.0, <=3.2.26) potentially affected by CVE-2026-45716 via @budibase/frontend-core (>=3.0.0, <=3.2.26)

@budibase/frontend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-45716 Source advisory: SNYK:JS-BUDIBASEFRONTENDCORE-16759691...

@elliemae/pui-e2e-test-sdk (>=11.0.0, <=12.4.4), froth-webdriverio-framework (>=7.0.119-dev1.0, <=9.0.6-ytlc7.5) potentially affected by CVE-2026-25244 via @wdio/browserstack-service (>=9.12.7, <=9.23.0)

@wdio/browserstack-service NPM version =9.12.7, =11.0.0, =7.0.119-dev1.0, =9.0.6-ytlc7.5 Source cves: CVE-2026-25244 Source advisory: OSV:GHSA-5C46-X3QW-Q7J7...

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2319 more potentially affected by CVE-2026-44902 via @opentelemetry/exporter-prometheus (>=0.9.0, <=0.216.0)

@opentelemetry/exporter-prometheus NPM version =0.9.0, =0.1.0, =0.1.0-dev.00aaa03, =0.1.1, =0.1.0, =0.0.1, =1.0.21, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.0.68 and more Source cves: CVE-2026-44902 Source advisor...

@datalayer/jupyter-react (>=0.0.6, <=0.9.5), @mrawdon/jupyter-react (>=0.0.23, <=0.0.32) potentially affected by CVE-2026-42557 via @jupyterlab/rendermime-extension (>=4.0.0, <=4.1.0-beta.0)

@jupyterlab/rendermime-extension NPM version =4.0.0, =0.0.6, =0.0.23, =0.0.32 Source cves: CVE-2026-42557 Source advisory: SNYK:JS-JUPYTERLABRENDERMIMEEXTENSION-16438958...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-26332 via vm2 (>=3.0.0, <=3.10.5)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...

@saltcorn/admin-models (>=1.5.0-beta.0, <=1.5.0), @saltcorn/base-plugin (>=1.5.0-beta.0, <=1.5.0) +5 more potentially affected by unknown CVE via @saltcorn/data (1.5.0-rc.2)

@saltcorn/data NPM version 1.5.0-rc.2 is affected by a known vulnerability. The following packages have a transitive dependency on @saltcorn/data and may be impacted: - @saltcorn/admin-models =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.0-beta.0,...

@agent-analytics/paperclip-live-analytics-plugin (>=0.1.1, <=0.1.11), @clawjedi/paperclip-plugin-chat (>=1.0.0, <=1.0.4) +16 more potentially affected by unknown CVE via @paperclipai/shared (>=2026.3.17-canary.0, <=2026.415.0-canary.7)

@paperclipai/shared NPM version =2026.3.17-canary.0, =0.1.1, =1.0.0, =0.0.1, =0.3.3, =0.1.0, =0.1.9, =2026.3.17-canary.0, =2026.3.17-canary.0, =2026.407.0-canary.5, =2026.3.17-canary.0, =2026.3.17-canary.2, =0.1.0, =2026.324.0-canary.0, =2026.325.0-canary.3 - corporateai 2026.328.0-canary.0 -...

@tinacms/app (>=0.0.0-07588d1-20260311013317, <=2.4.0), @tinacms/cli (>=0.0.0-07588d1-20260311013317, <=2.2.0) +4 more potentially affected by CVE-2026-34603 via @tinacms/graphql (>=2.0.0, <=2.2.1)

@tinacms/graphql NPM version =2.0.0, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =2.0.0, =0.0.0-0b7103c-20251216023146, =0.0.0-07588d1-20260311013317, =0.0.0-07588d1-20260311013317, =3.7.0 Source cves: CVE-2026-34603 Source advisory: OSV:GHSA-G87C-R2JP-293W...

@1771technologies/lytenyte-doc (1.0.13), @1771technologies/oneplay (>=0.0.1, <=0.0.6) +428 more potentially affected by CVE-2026-33769 via @astrojs/internal-helpers (>=0.0.0-markdoc-config-changes-20230626153541, <=0.7.5)

@astrojs/internal-helpers NPM version =0.0.0-markdoc-config-changes-20230626153541, =0.0.1, =1.0.0, =0.5.0, =1.0.0, =1.0.0, =0.0.17, =0.0.2, =0.2.0, =0.0.0-experimental-7c2f356, =0.0.0-experimental-7c2f356, =0.5.1 - @astro-sanctuary/toolbar-drupal 0.1.1 and more Source cves: CVE-2026-33769 Source...

@cesarechazu/directus-extension-generate-pdf (1.0.6) potentially affected by unknown CVE via @pdfme/schemas (5.5.8)

@pdfme/schemas NPM version 5.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on @pdfme/schemas and may be impacted: - @cesarechazu/directus-extension-generate-pdf 1.0.6 Source cves: unknown CVE Source advisory: SNYK:JS-PDFMESCHEMAS-15746947...

@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2025-46720 +1 more via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2025-46720, CVE-2026-33326 Source advisory:...

@oneuptime/cli (>=10.0.23, <=10.0.33) potentially affected by CVE-2026-33143 via @oneuptime/common (>=10.0.23, <=10.0.33)

@oneuptime/common NPM version =10.0.23, =10.0.23, =10.0.33 Source cves: CVE-2026-33143 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15842853...

@oneuptime/cli (>=10.0.5, <=10.0.33) potentially affected by CVE-2026-33142 via @oneuptime/common (>=10.0.5, <=10.0.33)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.33 Source cves: CVE-2026-33142 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15842854...

@oneuptime/cli (>=10.0.5, <=10.0.22) potentially affected by CVE-2026-32306 via @oneuptime/common (>=10.0.5, <=10.0.22)

@oneuptime/common NPM version =10.0.5, =10.0.5, =10.0.22 Source cves: CVE-2026-32306 Source advisory: SNYK:JS-ONEUPTIMECOMMON-15669899...

@deno/sandbox (>=0.0.9, <=0.6.0), @ekairos/cli (>=1.22.35, <=1.22.106-beta.feature-context-event-reaction-architecture.0) +64 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.6.3)

devalue NPM version =5.0.0, =0.0.9, =1.22.35, =1.22.102-beta.feature-lab-task-sandbox-beta.0, =1.21.52-beta.0, =1.22.4-beta.development.0, =1.22.13-beta.development.0, =1.22.39, =1.22.11-beta.development.0, =1.21.56-beta.0, =1.21.53-beta.0, =1.22.35, =1.21.88-beta.0, =0.0.0-dev-20260121145510,...

@activepieces/piece-amazon-s3 (>=0.5.4, <=0.6.4), @activepieces/piece-amazon-ses (>=0.0.1, <=0.1.4) +1116 more potentially affected by CVE-2026-25896 via fast-xml-parser (>=5.0.1, <=5.3.4)

fast-xml-parser NPM version =5.0.1, =0.5.4, =0.0.1, =0.1.3, =13.1.4, =1.0.0, =1.9.12, =1.0.3, =1.1.31, =1.0.0, =1.0.0, =1.7.16, =2.33.6, =1.4.37, =1.6.3 and more Source cves: CVE-2026-25896 Source advisory: OSV:GHSA-M7JM-9GC2-MPF2...

@flutchai/flutch-sdk (>=0.2.7, <=0.5.0) potentially affected by CVE-2026-27022 via @langchain/langgraph-checkpoint-mongodb (1.0.0)

@langchain/langgraph-checkpoint-mongodb NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @langchain/langgraph-checkpoint-mongodb and may be impacted: - @flutchai/flutch-sdk =0.2.7, =0.5.0 Source cves: CVE-2026-27022 Source advisory:...

@orval/angular (>=8.0.0-rc.0, <=8.0.1), @orval/axios (>=8.0.0-rc.0, <=8.0.1) +9 more potentially affected by CVE-2026-23947 +1 more via @orval/core (>=8.0.0, <=8.0.1)

@orval/core NPM version =8.0.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.6, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.0-rc.0, =8.0.1 Source cves: CVE-2026-23947, CVE-2026-25141 Source advisory: OSV:GHSA-H526-WF6G-67JV...