ROOT-APP-NPM-AIKIDO-2026-10718 AIKIDO-2026-10718 in @rootio/vm2 - Patched by Root

Root has patched AIKIDO-2026-10718 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-2CM2-M3W5-GP2F GHSA-2cm2-m3w5-gp2f in @rootio/vm2 - Patched by Root

Root has patched GHSA-2cm2-m3w5-gp2f in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44001 CVE-2026-44001 in @rootio/vm2 - Patched by Root

Root has patched CVE-2026-44001 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...

Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c48b9caf30af59020f36b25fb13fb54db5754b9d8ad311f857843171cc88915a The OpenSSF Package Analysis project identified 'relativity-pdfjs-dist' @ 5.8.2 npm as malicious. It is considered malicious because: - The...

ROOT-APP-NPM-CVE-2026-44288 CVE-2026-44288 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-44288 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-66414 CVE-2025-66414 in @rootio/modelcontextprotocol__sdk - Patched by Root

Root has patched CVE-2025-66414 in the @rootio/modelcontextprotocolsdk package for Root:npm. Multiple fixed versions available...

MAL-2026-10713 Malicious code in @hibachi-xyz/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2012c3b3a43f28209edf1c4b6fdbb0477c7c31f7574e37293cf7dd324f7f1e2f On require of the package's main entry, top-level code enumerates process.env and collects values whose keys match a credential-shaped regex KEY,...

ROOT-APP-NPM-CVE-2026-54286 CVE-2026-54286 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54286 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

MAL-2026-10696 Malicious code in loader1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9578c2db9f9fd58bb7b743e3ca8581aa21f4632bb965dcb53b7a4aaa02e5667 The package ships a single index.html declared as main whose only behavior is to fetch...

MAL-2026-10743 Malicious code in nordpass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9df6f21fababcd99ba522d380a0729d35aa4ff44ee2f6612fe75b906da844aee Package name impersonates the NordPass password-manager product while presenting itself as 'A simple authentication module.' The package.json...

ROOT-APP-NPM-CVE-2026-54306 CVE-2026-54306 in @rootio/n8n - Patched by Root

Root has patched CVE-2026-54306 in the @rootio/n8n package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-HV7X-3X78-GX53 GHSA-hv7x-3x78-gx53 in @rootio/n8n - Patched by Root

Root has patched GHSA-hv7x-3x78-gx53 in the @rootio/n8n package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44789 CVE-2026-44789 in @rootio/n8n - Patched by Root

Root has patched CVE-2026-44789 in the @rootio/n8n package for Root:npm. Multiple fixed versions available...

Malicious code in syft-acp-atoms (npm)

The syft-acp-atoms package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the 'syft-acp' internal/private package naming convention an ACP component library of a target...

MAL-2026-10762 Malicious code in @edgecommons/edgecommons (npm)

The @edgecommons/edgecommons package was published to the npm registry by user 'ada8877' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name uses an '@edgecommons' scope that mimics the internal/private package naming convention of a...

ROOT-APP-NPM-GHSA-Q4GF-8MX6-V5V3 GHSA-q4gf-8mx6-v5v3 in @rootio/next - Patched by Root

Root has patched GHSA-q4gf-8mx6-v5v3 in the @rootio/next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-8H8Q-6873-Q5FJ GHSA-8h8q-6873-q5fj in @rootio/next - Patched by Root

Root has patched GHSA-8h8q-6873-q5fj in the @rootio/next package for Root:npm. Multiple fixed versions available...

MAL-2026-10665 Malicious code in @fhkry/x-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db9f6c3e5c391d9d3ffeb7f6c1b4154b0266efeb73bdf5543ad81f50236bdabc This package presents itself as a fork of @whiskeysockets/baileys impersonating the original author 'Adhiraj Singh' in package.json and exposing the...

ROOT-APP-NPM-CVE-2025-13033 CVE-2025-13033 in @rootio/nodemailer - Patched by Root

Root has patched CVE-2025-13033 in the @rootio/nodemailer package for Root:npm. Multiple fixed versions available...

Malicious code in crypto-hasher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5162012006c5d2576c6f93540445f10185d44acfb5cef39764f7a2b45c45d205 [email protected] impersonates the hash-wasm library. Its main entrypoint dist/index.umd.js injects code into the WASM Interface update method so...