ROOT-APP-NPM-CVE-2026-9496 CVE-2026-9496 in pacote - Patched by Root

Root has patched CVE-2026-9496 in the pacote package for Root:npm. Multiple fixed versions available...

CVE-2021-32804

CVE-2021-32804 This is a repository for building the Docker environment used in the yamory blog "CVE-2021-32804 Path Traversal Vulnerability in node-tar Affecting npm". Environment Setup docker build -t cve-2021-32804 . docker run -it cve-2021-32804 /bin/bash Vulnerability Reproduction node-tar...

mini-shai-hulud-detector

Mini Shai-Hulud Detector One-command scanner for the Mini Shai-Hulud npm supply-chain attack CVE-2026-45321, CVSS 9.6. Critical: detect before rotating tokens The worm installs a persistence daemon gh-token-monitor that runs rm -rf if it detects credential revocation. Do not rotate your GitHub PA...

CVE-2026-11417-AWS-CDK-RCE

Supply Chain Command Injection in AWS CDK's NodejsFunction CVE-2026-11417 Author: Hesham Ashraf @HeshamASH Date: June 10, 2026 Severity: High CVSSv3.1: 7.3, CVSSv4: 7.0 CWE: CWE-78 — Improper Neutralization of Special Elements used in an OS Command OS Command Injection Affected Package: aws-cdk-l...

CVE-2026-39983

References https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-chqc-8p9q-pq6q https://github.com/patrickjuchli/basic-ftp/commit/2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b https://github.com/patrickjuchli/basic-ftp/releases/tag/v5.2.1...

npm-cve-2026-26830-26833

npm CVE index, March 2026 This repository is only a directory page for four public advisory repositories covering command injection vulnerabilities in npm packages assigned CVE IDs by MITRE on 2026-02-25. As of 2026-03-24, the latest npm release for each package is still affected: CVE| Package|...

ROOT-APP-NPM-AIKIDO-2026-553733 AIKIDO-2026-553733 in next - Patched by Root

Root has patched AIKIDO-2026-553733 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-2XP9-VWFH-VXW4 GHSA-2xp9-vwfh-vxw4 in next - Patched by Root

Root has patched GHSA-2xp9-vwfh-vxw4 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-Q4GF-8MX6-V5V3 GHSA-q4gf-8mx6-v5v3 in next - Patched by Root

Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-8H8Q-6873-Q5FJ GHSA-8h8q-6873-q5fj in next - Patched by Root

Root has patched GHSA-8h8q-6873-q5fj in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-64645 CVE-2026-64645 in next - Patched by Root

Root has patched CVE-2026-64645 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-75604 CVE-2026-75604 in next - Patched by Root

Root has patched CVE-2026-75604 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-H25M-26QC-WCJF GHSA-h25m-26qc-wcjf in next - Patched by Root

Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-5J59-XGG2-R9C4 GHSA-5j59-xgg2-r9c4 in next - Patched by Root

Root has patched GHSA-5j59-xgg2-r9c4 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44578 CVE-2026-44578 in next - Patched by Root

Root has patched CVE-2026-44578 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-64641 CVE-2026-64641 in next - Patched by Root

Root has patched CVE-2026-64641 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-48801 CVE-2026-48801 in linkify-it - Patched by Root

Root has patched CVE-2026-48801 in the linkify-it package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-59887 CVE-2026-59887 in linkify-it - Patched by Root

Root has patched CVE-2026-59887 in the linkify-it package for Root:npm. Multiple fixed versions available...

Malicious code in tailwind-fabric (npm)

tailwind-fabric 3.0.1, 3.0.4 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnxia1997 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in sc-announcer (npm)

Source: ossf-package-analysis 38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43 The OpenSSF Package Analysis project identified 'sc-announcer' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...