ROOT-APP-NPM-CVE-2026-44705 CVE-2026-44705 in tmp - Patched by Root

Root has patched CVE-2026-44705 in the tmp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-67214 CVE-2026-67214 in nanoid - Patched by Root

Root has patched CVE-2026-67214 in the nanoid package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-67213 CVE-2026-67213 in nanoid - Patched by Root

Root has patched CVE-2026-67213 in the nanoid package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-47068 CVE-2024-47068 in rollup - Patched by Root

Root has patched CVE-2024-47068 in the rollup package for Root:npm. Multiple fixed versions available...

MAL-2026-14346 Malicious code in @next-fonts/font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...

Malicious code in @next-fonts/font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e536e77176d5fb4637105c50280763e82a6a273dd7de35bb82da340b0f71163 @next-fonts/font is a typosquat of Next.js's @next/font. Its exported Inter function mimicking next/font/google decodes a base64 blob via atob, then...

Malicious code in mcq-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1acf694ae0258defc54c414980c5f8512b7055e69630ede15a8bfb37d2005b9b On any require/import of mcq-session, the main module runs a top-level async IIFE that reads a file at../../../../public/logo.ico a path escaping the...

Malicious code in moidevy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2eac79904b327f6508820c84c1350dd1bef3fc43eaf6e61d826f17ed5981d664 main.js imports childprocess and issues POST requests to a hardcoded endpoint at https://ipc.shadxino.internal referenced at lines 358 and 452, with...

Malicious code in express-session-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e94450f5541b39d8310a8b640dee027b0970db6e7cf724352726d49393bfb77 The package advertises itself as an Express session middleware but on module load unconditionally invokes an initPlugin routine in index.js that...

Malicious code in @js-lib-team/env-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae761b7dd660e94dd99388dedf8c2227fa6a683e314468e7a482cd649c2e1a47 Package @js-lib-team/env-parser is advertised as an environment-variable parser but on require/import executes a top-level IIFE in index.js that read...

Malicious code in chai-as-soul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244e923b668eb903bcc217cb1eda26ce2227f37bd14abc3699d60c222c4f4e62 [email protected] is a typosquat/repackage of pino: LICENSE, README, docs, and lib/ are copied from pinojs/pino, package.json description is unrelat...

NPM: gettext-converter: Prototype pollution in js2i18next() via crafted translation keys

NPM: gettext-converter: Prototype pollution in js2i18next via crafted translation keys vulnerability discovered by ? in WordPress Npm gettext-converter versions 1.3.3...

Malicious code in exam-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cd95c1b59238861675a30a947648a2280420c11e53dcb4f8501db5cb736313 On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../public/logo.ico, DES-decrypt...

MAL-2026-14331 Malicious code in exam-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29cd95c1b59238861675a30a947648a2280420c11e53dcb4f8501db5cb736313 On any require/import of exam-kit, the main entry runs a top-level await that reads an out-of-package file at../../../../public/logo.ico, DES-decrypt...

Malicious code in @pablo_clueless/printr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13ba2a3695f8d0fa63fb6558e66660f1e3b4a6f4eb080b86c486daae6f55102b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14330 Malicious code in @pablo_clueless/sniffr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e53d0f446873ba82f5cec59baa471da44bedb5386ddae175b8b501b9b038240 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @pablo_clueless/sniffr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e53d0f446873ba82f5cec59baa471da44bedb5386ddae175b8b501b9b038240 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14329 Malicious code in @pablo_clueless/printr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13ba2a3695f8d0fa63fb6558e66660f1e3b4a6f4eb080b86c486daae6f55102b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14328 Malicious code in goldstar-api-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 79d095fdd61f79c64b4b5d12ba75957b7c5de47df2bcfa549b05b23c7e450eba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in create-react-app-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7f200b99d8d2fadc13b72ccdd272107db79b8bc517ef5346a354479a177dff The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...