194725 matches found
Malicious code in bunnyhijack-test-0x00 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b21307c316c7a3237991fdfb6dc4d43716997a91268f43fe9c9c65a3fd76e package.json declares "bin": "node": "./shim.js" , which causes npm to place a node executable into nodemodules/.bin. Since nodemodules/.bin is...
CVE-2026-76230
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...
CVE-2026-76230
Renovate (renovatebot/renovate) versions 35.63.0 through 40.32.x contain a command injection vulnerability in the npm manager . The root cause is that user-provided packageName values are appended to npm install commands in lib/modules/manager/npm/post-update/npm.ts without being escaped via the ...
CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...
EUVD-2026-62471
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...
CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm
Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...
ROOT-APP-NPM-CVE-2026-48779 CVE-2026-48779 in ws - Patched by Root
Root has patched CVE-2026-48779 in the ws package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-9678 CVE-2026-9678 in undici - Patched by Root
Root has patched CVE-2026-9678 in the undici package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-13697 CVE-2026-13697 in undici - Patched by Root
Root has patched CVE-2026-13697 in the undici package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-30260 CVE-2024-30260 in undici - Patched by Root
Root has patched CVE-2024-30260 in the undici package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-30261 CVE-2024-30261 in undici - Patched by Root
Root has patched CVE-2024-30261 in the undici package for Root:npm. Multiple fixed versions available...
GHSA-7788-GHFQ-C6MH
creationtimestamp| type| source ---|---|--- 2026-08-19 10:31:45+00:00| seen| https://gist.github.com/alon710/0cc60371850e568781debde747fcbd5a...
Malicious code in evm-validation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...
MAL-2026-14301 Malicious code in evm-validation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c551a6031e48a54b550a604e2198a4491cf935407744bba8ef0c11c54086c4 The package advertises EVM address validation but performs no local validation. Its single exported function validatede in index.js issues axios.get...
Malicious code in eth-react-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b9bdf79a694cbf6d1a840541b4c47fdac8dc6ac32f4b6a3d4887d5f81233387 The package advertises itself as a React Ethereum provider exporting EthereumProvider/useProvider/useSigner/useNetwork hooks, but the shipped main...
Malicious code in emoji-prints-fancy (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163576a0a8b626c88261c8cc54c5049d981015c80145ad36e2710fff5014afbe The package advertises itself as a colorized logger, but dist/index.js requires./logger, which at module load AES-256-CBC-decrypts a hardcoded...
ROOT-APP-NPM-CVE-2026-26996 CVE-2026-26996 in minimatch - Patched by Root
Root has patched CVE-2026-26996 in the minimatch package for Root:npm. Multiple fixed versions available...
Malicious code in gear-composer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f697d2d145e4ade11da0d34433b5f69b46fde8736031c5ffe63af4d2f843eaad The package ships multiple components consistent with an install-time credential harvest and exfiltration pipeline. scripts/postinstall-agent.mjs is...