195888 matches found
MAL-2026-16273 Malicious code in blue-string-formatter-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET ...
CVE-2023-37478_npm_vs_pnpm
pnpm vs npm エクスプロイト このリポジトリは、tarball からの npm と pnpmのインストール方法の違いがどのように悪用され得るかを示しています。 このエクスプロイトは CVE-2023-37478 に記録されています。 ここで構築された JavaScript パッケージは、ユーザーに良いメッセージを表示すると主張しています。npm でインストールした場合、これは本当です。 しかし、同じパッケージを pnpm でインストールすると、意地悪なメッセージが表示されます。 これがより悪意のある形で悪用される可能性は想像に難くないでしょう。...
CVE-2026-71538
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...
bigint-buffer-js
bigint-buffer-js [email protected] 的直接替代品，无需原生绑定 。 bigint-buffer ≤ 1.1.5 的原生 toBigIntLE 存在缓冲区溢出漏洞（CVE-2025-3194 / GHSA-3gc7-fjrx-p6mg），且尚未发布修复版本。 它通过 @solana/buffer-layout-utils → @solana/spl-token 被间接引入。 本包保留了与原版完全相同的 API 以及纯 JavaScript 代码路径 （toBigIntLE、toBigIntBE、toBufferLE、toBufferBE），安装时...
MAL-2026-16255 Malicious code in randompkga (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...
Malicious code in randompkga (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...
@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
Summary A Windows-specific command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace option. User-supplied --workspace values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling...
CVE-2026-71538
@cyclonedx/cyclonedx-npm prior to 6.0.0 is vulnerable to a Windows-specific shell injection in the fallback execution path of src/npmRunner.ts, used when npm_execpath does not resolve the npm CLI. An untrusted value passed to the --workspace option is incorporated into a shell command without san...
CVE-2026-71538 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows
@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...
shai-scan
shai-scan npmおよびPyPIのサプライチェーン侵害をスキャンするゼロ依存CLIツール なぜ？ 2026年5月11日、Mini Shai-Hulud （CVE-2026-45321、GHSA-g7cv-rxg3-hmpx）と名付けられた自己増殖型サプライチェーンワームがnpmエコシステムを侵害しました。TeamPCP （別名DeadCatx3、PCPcat、ShellForce、CipherForce）によるものとされ、このマルウェアはGitHub ActionsのOIDCトークンを乗っ取り、有効なSLSA Build Level...
ROOT-APP-NPM-CVE-2026-56876 CVE-2026-56876 in extract-zip - Patched by Root
Root has patched CVE-2026-56876 in the extract-zip package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10759 AIKIDO-2026-10759 in next - Patched by Root
Root has patched AIKIDO-2026-10759 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-45109 CVE-2026-45109 in next - Patched by Root
Root has patched CVE-2026-45109 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44574 CVE-2026-44574 in next - Patched by Root
Root has patched CVE-2026-44574 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-59471 CVE-2025-59471 in next - Patched by Root
Root has patched CVE-2025-59471 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44581 CVE-2026-44581 in next - Patched by Root
Root has patched CVE-2026-44581 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2025-10936 AIKIDO-2025-10936 in next - Patched by Root
Root has patched AIKIDO-2025-10936 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10757 AIKIDO-2026-10757 in next - Patched by Root
Root has patched AIKIDO-2026-10757 in the next package for Root:npm. Multiple fixed versions available...