brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

MAL-2026-13705 Malicious code in iconova-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4590534a7b05eb30959d9422e2ea700fb525b66b357a62f7ba1795caba4ad799 iconova-react is a re-hosted copy of lucide-react every icon file carries a @license lucide-react header; the package name is iconova-react but its...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e6f280e621703ad0ddfe97298c5a5dded61dd1b8fc877729ad0202f6a23a77 Package [email protected] shows no evidence of exfiltration, install-time remote code execution,...

MAL-2026-13674 Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56afa18eac7769497f21431af2a739dd5040563541223e41786746e0c44957a2 Package contains 2 files with no static or behavioral indicators of supply-chain attack shapes. No lifecycle scripts fetching remote content, no...

MAL-2026-13671 Malicious code in statist-browser-typed-client-eventea.projects.pwahelp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd82004d1cbf2e4b6a3c77f48293b0d9638fe59592eb40291b6a332121f6fe6 Package contains no code paths that read installer secrets, fetch and execute remote content, relay caller data to third-party destinations, or...

MAL-2026-13675 Malicious code in statist-browser-typed-client-eventea.projects.tdevice (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dbd4923fdddd3bf528bfd2bc560ffe7963b22ed9df844e60f6fe2f778f15720 Package [email protected] contains only two files and shows no code performing credential access, network...

MAL-2026-13672 Malicious code in statist-browser-typed-client-eventea.projects.pwainsurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4836c93e5c62158ffed799c206fa3713291692e10efae048c04fff0745f7070f Package [email protected] contains no code patterns matching known supply-chain attack fingerprints. N...

MAL-2026-13677 Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...

MAL-2026-13679 Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...

Malicious code in @rbx-ts/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9476bbe7c2ce12348142e93deffe53c9d4d6dfef3400030af81cff902bac5935 This package impersonates the @rbxts/services Roblox typings library and re-exports its public API in index.js as cover. Its postinstall script...

MAL-2026-13678 Malicious code in svelte-map-visual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...

Malicious code in svelte-map-visual (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6454f69cbd9ee5dce9ba329c1c395a782bc495299a6eeec26455451416f7f37 No malicious behavior was identified in this package version. No lifecycle scripts fetching or executing remote content, no credential or...

Malicious code in @lambda-platform/lambda-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405a4d9bac602cd3fca6afbcee8dde788580934920352178864343fab46fa64b No static or traced-code signals of exfiltration, install-time remote code execution, silent-relay, credential distribution, backdoor, or...

ROOT-APP-NPM-GHSA-8H8Q-6873-Q5FJ GHSA-8h8q-6873-q5fj in next - Patched by Root

Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-Q4GF-8MX6-V5V3 GHSA-q4gf-8mx6-v5v3 in next - Patched by Root

Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available...

Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

MAL-2026-13491 Malicious code in rdfxvela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911 cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand signup/login/list/download/deploy, th...

Malicious code in rdfxvela (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d55d64f24399db1a58a47cf2115a125bdc505d5d9c3bcf0d128e398f2dc6911 cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey. When the user invokes any rx subcommand signup/login/list/download/deploy, th...