ROOT-APP-NPM-AIKIDO-2026-424618 AIKIDO-2026-424618 in basic-ftp - Patched by Root

Root has patched AIKIDO-2026-424618 in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-102990 CVE-2026-102990 in basic-ftp - Patched by Root

Root has patched CVE-2026-102990 in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41324 CVE-2026-41324 in basic-ftp - Patched by Root

Root has patched CVE-2026-41324 in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-28863 CVE-2024-28863 in tar - Patched by Root

Root has patched CVE-2024-28863 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-24842 CVE-2026-24842 in tar - Patched by Root

Root has patched CVE-2026-24842 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-59873 CVE-2026-59873 in tar - Patched by Root

Root has patched CVE-2026-59873 in the tar package for Root:npm. Multiple fixed versions available...

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence AI credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tool...

CVE-2026-31802

🛡️ CVE-2026-31802 - Simple Proof of Concept Viewer 📋 About CVE-2026-31802 This repository provides a proof of concept PoC and write-up for CVE-2026-31802. The issue is a security vulnerability in the npm tar package. It allows attackers to trick the software into writing files outside its allowed...

scan-shai-hulud

scan-shai-hulud A fast, zero-dependency Bash scanner to detect whether your machine is affected by the CVE-2026-45321 "Mini Shai-Hulud" supply chain attack. On May 11, 2026, over 170 npm packages and 2 PyPI packages across TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI were...

PolinRider

PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos Date: 2026-03-07 Last updated: 2026-04-11 — see April 10–11 Update below Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious...

certighost-cve-2026-54121-slides

Certighost Slidev deck This directory contains the Slidev presentation for CVE-2026-54121.md. npm install npm run dev Other commands: npm run build npm run export The source deck is slides.md. Deck-wide styling is in style.css, and Mermaid settings are in setup/mermaid.ts...

Malicious code in aemath-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4ba11c491c52f6a459598d106fb4a592940ca56221cf5795c47f998bd5009bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zeroz-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55c04838c571c7688a361345f76683eefc0e7b1da6719b53cef0285f55b7f99b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in aldi02-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52aad2c9e9c773ff8cc1529316069d58541e3fa677cda7ff75364c644154eb59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21768e52f5deae2143dcb4b348368fb1a07efa47856a868a24a0977a52889ce6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17449 Malicious code in prastzyy (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in prastzyy (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

MAL-2026-17410 Malicious code in xzbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in xcvrenzcompany (npm)

This package is a fork of the Baileys WhatsApp Web library npm and belongs to the "PhantomSub" family described by OX Security in September 2026: the publisher injected code that, without the installer asking, uses the installer's own authenticated WhatsApp session to subscribe that account to...

Malicious code in xzvexpzcbailey (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...