Malicious code in mxckjdgweuxpsiohd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac994d415521db946a7f88a0915ff5e7b89d53569d4227980d3a9832f06ec3e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vjkpwjxbvndelta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 232e538a22dccee3bbca452b7b7ef7cea92bcc79d32cc7586099520703efe763 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zxhgssiyluwxchn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e026531d4c72147180eef854ceee292ef8cf4da100b348ff7eb526734c249d64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nsdhjuiwqxmhsf1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c744817916474123d9e76c5a569eb6c71387549bdfe29cd4c99dc0e6182d134 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ticketcathayoct12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a300a5638b1fca85ef0319ef8c86ed446e362626f8704a7ba7ae8e0317b5b6d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-21315-PoC

CVE-2021-21315-systeminformation This is Proof of Concept for CVE-2021-21315 which affects The System Information Library for Node.JS npm package "systeminformation". npmjs.com/systeminformation "be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite,...

ROOT-APP-NPM-CVE-2026-73566 CVE-2026-73566 in tar - Patched by Root

Root has patched CVE-2026-73566 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-26960 CVE-2026-26960 in tar - Patched by Root

Root has patched CVE-2026-26960 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-424618 AIKIDO-2026-424618 in basic-ftp - Patched by Root

Root has patched AIKIDO-2026-424618 in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41324 CVE-2026-41324 in basic-ftp - Patched by Root

Root has patched CVE-2026-41324 in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-102990 CVE-2026-102990 in basic-ftp - Patched by Root

Root has patched CVE-2026-102990 in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2024-28863 CVE-2024-28863 in tar - Patched by Root

Root has patched CVE-2024-28863 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-24842 CVE-2026-24842 in tar - Patched by Root

Root has patched CVE-2026-24842 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-59873 CVE-2026-59873 in tar - Patched by Root

Root has patched CVE-2026-59873 in the tar package for Root:npm. Multiple fixed versions available...

electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic

A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence AI credits for Anthropic Claude and Google Gemini, coding tools, and security audits. "The tool...

CVE-2026-31802

🛡️ CVE-2026-31802 - Simple Proof of Concept Viewer 📋 About CVE-2026-31802 This repository provides a proof of concept PoC and write-up for CVE-2026-31802. The issue is a security vulnerability in the npm tar package. It allows attackers to trick the software into writing files outside its allowed...

cve-lite-cli

Most tools tell you what's wrong. CVE Lite CLI tells you what to run. CVE Lite CLI 🏆 Officially recognized as anOWASP Lab Project Vulnerability scanning that starts in your terminal and fits cleanly into CI. Scan your lockfile, get copy-and-run fix commands, and ship clean code. Scan. Understand...

scan-shai-hulud

scan-shai-hulud A fast, zero-dependency Bash scanner to detect whether your machine is affected by the CVE-2026-45321 "Mini Shai-Hulud" supply chain attack. On May 11, 2026, over 170 npm packages and 2 PyPI packages across TanStack, Mistral AI, UiPath, OpenSearch, and Guardrails AI were...

PolinRider

PolinRider: DPRK Threat Actor Implants Malware in Hundreds of GitHub Repos Date: 2026-03-07 Last updated: 2026-04-11 — see April 10–11 Update below Severity: CRITICAL — active supply chain infection across 1,950+ public repositories, confirmed operational merger with the TasksJacker / Contagious...