scanner-cli

Deprecation Notice: Hawkeye has reached its end of life. There are more modern options out there for you and your project. If you wish to pick up maintenance of the project, please feel free to contact me. You'll find means of reaching out to me on my personal homepage. . . . . . . The Hawkeye...

aura

This repository has moved to a new location: https://github.com/SourceCode-AI/aura Security Auditing and code introspection About the problem The current trend in the development is to use a lot of packages in the development phase, even if they provide only trivial functionality and consist of 1...

ROOT-APP-NPM-GHSA-F88M-G3JW-G9CJ GHSA-f88m-g3jw-g9cj in sharp - Patched by Root

Root has patched GHSA-f88m-g3jw-g9cj in the sharp package for Root:npm. Multiple fixed versions available...

MAL-2026-16273 Malicious code in blue-string-formatter-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565 The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET ...

CVE-2023-37478_npm_vs_pnpm

pnpm vs npm exploit This repo showcases how a difference in npm and pnpminstallation from tarballs can be exploited. The exploit is recorded in CVE-2023-37478. The javascript package constructed here claims it prints out a nice message to the user. When installed with npm, this is true. However,...

CVE-2026-71538

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...

bigint-buffer-js

bigint-buffer-js Remplacement direct de [email protected] sans la liaison native. bigint-buffer ≤ 1.1.5 présente un débordement de tampon dans la fonction native toBigIntLE CVE-2025-3194 / GHSA-3gc7-fjrx-p6mg et aucune version corrigée n'a été publiée. Il est tiré de manière transitive par...

Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...

MAL-2026-16255 Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...

@cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

Summary A Windows-specific command injection vulnerability exists in @cyclonedx/cyclonedx-npm when the CLI is invoked with the --workspace option. User-supplied --workspace values can be passed to a shell command without proper neutralization on the Windows fallback execution path, enabling...

CVE-2026-71538

@cyclonedx/cyclonedx-npm prior to 6.0.0 is vulnerable to a Windows-specific shell injection in the fallback execution path of src/npmRunner.ts, used when npm_execpath does not resolve the npm CLI. An untrusted value passed to the --workspace option is incorporated into a shell command without san...

CVE-2026-71538 @cyclonedx/cyclonedx-npm: Shell Injection via Unsanitized --workspace Argument on Windows

@cyclonedx/cyclonedx-npm creates CycloneDX Software Bill of Materials from npm projects. Prior to version 6.0.0, the Windows fallback path in src/npmRunner.ts, used when npmexecpath does not provide the npm CLI path, can construct a shell command containing an untrusted value from the --workspace...

shai-scan

shai-scan Scanner CLI sans dépendances pour les compromissions de la chaîne d'approvisionnement npm et PyPI. Pourquoi ? Le 11 mai 2026, un ver auto-propagateur de la chaîne d'approvisionnement surnommé Mini Shai-Hulud CVE-2026-45321, GHSA-g7cv-rxg3-hmpx a compromis l'écosystème npm. Attribué à...

ROOT-APP-NPM-CVE-2026-56876 CVE-2026-56876 in extract-zip - Patched by Root

Root has patched CVE-2026-56876 in the extract-zip package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10759 AIKIDO-2026-10759 in next - Patched by Root

Root has patched AIKIDO-2026-10759 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-45109 CVE-2026-45109 in next - Patched by Root

Root has patched CVE-2026-45109 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44574 CVE-2026-44574 in next - Patched by Root

Root has patched CVE-2026-44574 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-59471 CVE-2025-59471 in next - Patched by Root

Root has patched CVE-2025-59471 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2025-10936 AIKIDO-2025-10936 in next - Patched by Root

Root has patched AIKIDO-2025-10936 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10758 AIKIDO-2026-10758 in next - Patched by Root

Root has patched AIKIDO-2026-10758 in the next package for Root:npm. Multiple fixed versions available...