Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

Malicious code in veloq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0f85e80ad1893e8546161034450eaac2165d5eb7299710f0870bc26b05b2 [email protected] is a near-verbatim fork of gulplog rebranded by 'Blockvora Team', with two injected lines inside getLogger in index.js: a call to...

MAL-2026-14561 Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

MAL-2026-14562 Malicious code in morglog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70fd694cbd6fff160cc788117eac2e85e921870f0a2a2e24dbaf81418ed19a1 [email protected] is published under a name resembling the popular morgan HTTP logger and reuses morgan's description. The tarball ships only LICENSE,...

MAL-2026-14566 Malicious code in veloq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0f85e80ad1893e8546161034450eaac2165d5eb7299710f0870bc26b05b2 [email protected] is a near-verbatim fork of gulplog rebranded by 'Blockvora Team', with two injected lines inside getLogger in index.js: a call to...

Malicious code in morglog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70fd694cbd6fff160cc788117eac2e85e921870f0a2a2e24dbaf81418ed19a1 [email protected] is published under a name resembling the popular morgan HTTP logger and reuses morgan's description. The tarball ships only LICENSE,...

MAL-2026-14564 Malicious code in sigcheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6acb99271ede5807243bea2648af5e71511853e99c473309de457a8828ac0ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

ROOT-APP-NPM-CVE-2025-64530 CVE-2025-64530 in @apollo/composition - Patched by Root

Root has patched CVE-2025-64530 in the @apollo/composition package for Root:npm. Multiple fixed versions available...

CVE-2026-42931

A flaw was found in Gitea. An authenticated attacker can trigger a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The server attempts to read the entire request body into memory without a size limit, leading to an Out-of-Memory OOM error and crashing the...

CVE-2026-76230

A flaw was found in Renovate. This vulnerability, a command injection, exists within the npm manager due to improper sanitization of user-provided package names. An attacker with write access to a repository can exploit this by crafting malicious Renovate configuration files. This allows them to...

ROOT-APP-NPM-CVE-2026-33896 CVE-2026-33896 in node-forge - Patched by Root

Root has patched CVE-2026-33896 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33891 CVE-2026-33891 in node-forge - Patched by Root

Root has patched CVE-2026-33891 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-66031 CVE-2025-66031 in node-forge - Patched by Root

Root has patched CVE-2025-66031 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33895 CVE-2026-33895 in node-forge - Patched by Root

Root has patched CVE-2026-33895 in the node-forge package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-33894 CVE-2026-33894 in node-forge - Patched by Root

Root has patched CVE-2026-33894 in the node-forge package for Root:npm. Multiple fixed versions available...

MAL-2026-14559 Malicious code in imo-allowlist-xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f429a987c3b4800204131b27faae0c29e55a0761a1fa2a0306ab14a343afd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

Malicious code in imo-allowlist-xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f429a987c3b4800204131b27faae0c29e55a0761a1fa2a0306ab14a343afd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14563 Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...