CVE-2026-76230

Renovate (renovatebot/renovate) versions 35.63.0 through 40.32.x contain a command injection vulnerability in the npm manager . The root cause is that user-provided packageName values are appended to npm install commands in lib/modules/manager/npm/post-update/npm.ts without being escaped via the ...

CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

EUVD-2026-62471

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

ROOT-APP-NPM-CVE-2026-13697 CVE-2026-13697 in undici - Patched by Root

Root has patched CVE-2026-13697 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9678 CVE-2026-9678 in undici - Patched by Root

Root has patched CVE-2026-9678 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-30260 CVE-2024-30260 in undici - Patched by Root

Root has patched CVE-2024-30260 in the undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-30261 CVE-2024-30261 in undici - Patched by Root

Root has patched CVE-2024-30261 in the undici package for Root:npm. Multiple fixed versions available...

GHSA-7788-GHFQ-C6MH

creationtimestamp| type| source ---|---|--- 2026-08-19 10:31:45+00:00| seen| https://gist.github.com/alon710/0cc60371850e568781debde747fcbd5a...

Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

MAL-2026-14301 Malicious code in evm-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...

Malicious code in eth-react-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387 The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main...

Malicious code in emoji-prints-fancy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163576a0a8b626c88261c8cc54c5049d981015c80145ad36e2710fff5014afbe The package advertises itself as a colorized logger, but dist/index.js requires./logger, which at module load AES-256-CBC-decrypts a hardcoded...

Malicious code in gear-composer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f697d2d145e4ade11da0d34433b5f69b46fde8736031c5ffe63af4d2f843eaad The package ships multiple components consistent with an install-time credential harvest and exfiltration pipeline. scripts/postinstall-agent.mjs is...

ROOT-APP-NPM-CVE-2026-47429 CVE-2026-47429 in vitest - Patched by Root

Root has patched CVE-2026-47429 in the vitest package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-24964 CVE-2025-24964 in vitest - Patched by Root

Root has patched CVE-2025-24964 in the vitest package for Root:npm. Multiple fixed versions available...

Malicious code in mc-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc Package publishes as mc-registry with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the...

MAL-2026-14294 Malicious code in mc-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc Package publishes as mc-registry with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the...

MAL-2026-14271 Malicious code in nodeberlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...

MAL-2026-14272 Malicious code in price-scripping-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b5a1792ab4822af305a8d853e858a8063d9e82e5d91d3dbd3a748300aaf7f9 [email protected] runs node dist/postinstall.js as its npm postinstall script. That entry point resolves the installing project's root via...