Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

Malicious code in n8n-nodes-devops-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 464fa8baaffef716b3920968d35dfbf6c8d49cd439ad5c5bd45050074436d79b Package masquerades as an n8n community node package.json declares n8n.nodes: "MyNode.js", a trivial placeholder while index.js contains an unrelated...

ROOT-APP-NPM-CVE-2024-28863 CVE-2024-28863 in @rootio/tar - Patched by Root

Root has patched CVE-2024-28863 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-32997 CVE-2025-32997 in @rootio/http-proxy-middleware - Patched by Root

Root has patched CVE-2025-32997 in the @rootio/http-proxy-middleware package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-76MC-F452-CXCM GHSA-76mc-f452-cxcm in @rootio/dompurify - Patched by Root

Root has patched GHSA-76mc-f452-cxcm in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-49978 CVE-2026-49978 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-49978 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-H8R8-WCCR-V5F2 GHSA-h8r8-wccr-v5f2 in @rootio/dompurify - Patched by Root

Root has patched GHSA-h8r8-wccr-v5f2 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-CJMM-F4JC-QW8R GHSA-cjmm-f4jc-qw8r in @rootio/dompurify - Patched by Root

Root has patched GHSA-cjmm-f4jc-qw8r in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-CJ63-JHHR-WCXV GHSA-cj63-jhhr-wcxv in @rootio/dompurify - Patched by Root

Root has patched GHSA-cj63-jhhr-wcxv in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-49459 CVE-2026-49459 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-49459 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41238 CVE-2026-41238 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-41238 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41240 CVE-2026-41240 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-41240 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48712 CVE-2026-48712 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-48712 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41242 CVE-2026-41242 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-41242 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44291 CVE-2026-44291 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-44291 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44288 CVE-2026-44288 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-44288 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-66414 CVE-2025-66414 in @rootio/modelcontextprotocol__sdk - Patched by Root

Root has patched CVE-2025-66414 in the @rootio/modelcontextprotocolsdk package for Root:npm. Multiple fixed versions available...

MAL-2026-10713 Malicious code in @hibachi-xyz/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2012c3b3a43f28209edf1c4b6fdbb0477c7c31f7574e37293cf7dd324f7f1e2f On require of the package's main entry, top-level code enumerates process.env and collects values whose keys match a credential-shaped regex KEY,...

ROOT-APP-NPM-CVE-2026-54286 CVE-2026-54286 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54286 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44456 CVE-2026-44456 in @rootio/hono - Patched by Root

Root has patched CVE-2026-44456 in the @rootio/hono package for Root:npm. Multiple fixed versions available...