ROOT-APP-NPM-CVE-2026-44288 CVE-2026-44288 in protobufjs - Patched by Root

Root has patched CVE-2026-44288 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-21884 CVE-2026-21884 in @rootio/react-router - Patched by Root

Root has patched CVE-2026-21884 in the @rootio/react-router package for Root:npm. Multiple fixed versions available...

EUVD-2025-210592

better-auth npm before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined e.g., BETTERAUTHURL is unset. An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users...

MAL-2026-11498 Malicious code in @custombots/custombot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 07c87d7c1e7e788959af6de895c76293fd0922dd1a422da325962de7f8d3d19a The OpenSSF Package Analysis project identified '@custombots/custombot' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2026-11466 Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dce1db42ec3c0d5758c442c943859f877d4cc877644cc4116df2678ab8b0527 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11459 Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1017256693a94381e0b07af053580670a0cd8b3e5868954aba49474d32cd8c18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11482 Malicious code in sap-mcp-facilitator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bfa674a61d22c14e8a76f398231dc1a1052b02fb635dcccc2e72f69565eba68d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11457 Malicious code in capacitor-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b3684fbb41e490eea74489dc2453b1f37022ced6d2fba0c72a82ebbc42f4f80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11486 Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c29928c7b086fd3efb53a2f1850b92a2f76f6e7e54f037fd2b87632b77208fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11476 Malicious code in polyprompt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c83b81c4da433d42ff97456ac6c52970f52de665ee78be41fd4c4ee34705adf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11480 Malicious code in routerbase-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bcc3239685adaf9098cfcf2a9f30c0018357be5ad058caf2046534c516bc3a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11463 Malicious code in goldenflow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6d0c7798c31f2743649318d78a1937fd28af9e4c28a2808046b647f2c087568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...

MAL-2026-11499 Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

MAL-2026-11160 Malicious code in @joyfill/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61cf3fd63a92e5d2f5ffdbc70713656d7b347072c046aed9e9ba65fbc7c1e76e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11151 Malicious code in text-line-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7e51069873e7107964bf35c4ad5deace11fd5269366791475b18d0426902749 The package advertises itself as a text/line parsing utility, but its shipped index.js contains only unrelated color-conversion stubs...

MAL-2026-11121 Malicious code in @apexfnd/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8716e3bd410648407039879f991abe8adbde650ab008bac4e41165e7b52c79b1 The npm package @apexfnd/apex ships a postinstall script install.cjs that performs two install-time remote-code-execution actions. On macOS it writes...

MAL-2026-11153 Malicious code in triage_bot_using_sdkv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed39efd544cae19da3ed546fecb2383729aef637bf623e00a9cf02f1f8ded05c package.json registers a preinstall hook that runs index.js on npm install. index.js collects os.hostname, os.userInfo, home directory, DNS server...

MAL-2026-11129 Malicious code in app-svm-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc1e4595c58a335fee4df04e6d25f61c8a88e8c0e6192bce21f13f8e16ff87a1 package.json declares postinstall=node test.js, which auto-executes on npm install and runs two malicious flows. First, test.js fetches an attacker S...