ROOT-APP-NPM-CVE-2026-4926 CVE-2026-4926 in path-to-regexp - Patched by Root

Root has patched CVE-2026-4926 in the path-to-regexp package for Root:npm. Multiple fixed versions available...

Exploit for CVE-2022-24481

No d...

@rse/claudex (1.0.11) potentially affected by CVE-2026-73055 via shescape (3.0.1)

shescape NPM version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on shescape and may be impacted: - @rse/claudex 1.0.11 Source cves: CVE-2026-73055 Source advisory: SNYK:JS-SHESCAPE-18855681...

@rse/claudex (>=0.9.22, <=1.0.10), @snyk/snyk-cocoapods-plugin (>=2.6.0, <=3.1.2) +6 more potentially affected by CVE-2026-73055 via shescape (>=2.1.0, <=2.1.14)

shescape NPM version =2.1.0, =0.9.22, =2.6.0, =2.0.0, =8.0.0, =6.0.0, =3.0.0, =3.0.0, =3.1.4 Source cves: CVE-2026-73055 Source advisory: SNYK:JS-SHESCAPE-18855681...

Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

MAL-2026-14068 Malicious code in depcruise-wrap-stream-in-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...

MAL-2026-14067 Malicious code in upload-to-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...

MAL-2026-14065 Malicious code in akamai-sensor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178 Package published under a name impersonating Akamai's sensordata anti-bot SDK. index.js contains a /... / comment whose body is encoded in invisible...

@appweaver/core (>=1.0.8, <=1.4.1), @buildplease/apikit (>=1.0.0, <=1.0.1) +15 more potentially affected by CVE-2026-19474 via @fastify/multipart (>=10.0.0, <=10.1.0)

@fastify/multipart NPM version =10.0.0, =1.0.8, =1.0.0, =4.0.1, =5.3.0, =0.0.17, =2.5.0, =2.2.1, =20260128.2248.28, =20260411.1248.30, =20260828.1636.54, =1.0.1, =0.11.0, =0.0.0-unstable.9f53ea597d, =5.21.1-beta.15, =6.0.1-alpha.2 and more Source cves: CVE-2026-19474 Source advisory:...

@appweaver/core (>=1.0.0, <=1.4.1), @bryopsida/object-store (>=0.1.0, <=0.1.7) +11 more potentially affected by CVE-2026-18165 via @fastify/oauth2 (>=7.9.0, <=8.2.0)

@fastify/oauth2 NPM version =7.9.0, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.13.0, =1.4.30, =1.2.0, =0.0.14, =0.0.19 Source cves: CVE-2026-18165 Source advisory: SNYK:JS-FASTIFYOAUTH2-18902506...

@appweaver/core (>=1.0.8, <=1.4.1), @buildplease/apikit (>=1.0.0, <=1.0.1) +15 more potentially affected by CVE-2026-18549 via @fastify/multipart (>=10.0.0, <=10.1.0)

@fastify/multipart NPM version =10.0.0, =1.0.8, =1.0.0, =4.0.1, =5.3.0, =0.0.17, =2.5.0, =2.2.1, =20260128.2248.28, =20260411.1248.30, =20260828.1636.54, =1.0.1, =0.11.0, =0.0.0-unstable.9f53ea597d, =5.21.1-beta.15, =6.0.1-alpha.2 and more Source cves: CVE-2026-18549 Source advisory:...

MAL-2026-14064 Malicious code in @finaxis/common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 832d1ce61ce1f1e1430c60e94175cc80700dfbb2f8d0f46fd7d00b64720026d8 Package publishes under a lodash-imitating identity: keywords lodash/lodash-js, and the README is a verbatim copy of the official lodash 4.18.1 READM...

Malicious code in adxaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9 The tarball stages an obfuscated JavaScript payload i.js, with an un-obfuscated copy in original.js that gates on window.location.href containing...

Malicious code in @openrepl/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fcd297122e7aac00cd0d3d92fcb5f1fc00b6c558571a037b5447eb64bd443b8 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js shells out via childprocess to execute curl -X...

Malicious code in fastly-vcl-language-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...

Malicious code in twilio-hackerone-poc-afe6937c (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...

Malicious code in hunterone-build-probe-9210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e probe.js runs automatically via package.json preinstall and postinstall hooks "node probe.js || true". On execution it collects os.hostname,...

MAL-2026-14062 Malicious code in tw-pkgprobe-7731 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...

Malicious code in tw-pkgprobe-7731 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...

Malicious code in autbank-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d On npm install, preinstall.js enumerates process.env for keys matching credential substrings KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH...