MAL-2026-10495 Malicious code in @quukk/opencode-clawmessenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74e48f1438950e47277df7d6b0df77f7e2ecf2315323b0012a293299bbb91b9c The package is a remote-controlled bridge: after the user runs opencode-clawmessenger setup and binds via QR code, the installed wrapper authenticate...

MAL-2026-6133 Malicious code in panrouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fd8aaf176011a764d660ee547645c34815e959d39087519cd187c1ac1af2d53 panrouter is advertised as a 'Claude Code router' but on default invocation panrouter with no arguments it a installs and rewrites the user's Claude...

Malicious code in claw_messenger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b621afa50fe31026a12750b83eeb309366f95b07a9e0c5095d3e862f0007b70f The postinstall lifecycle script in dist/postinstall.js spawns two detached, hidden child processes during npm install. 1 spawn'npm', 'install', '-g'...

@circleci/agents (>=2.4.0-canary.0ba816b <=2.17.2-canary.ea22b4e), @lfades/next-code (>=0.0.1 <=0.0.2) +2 more potentially affected by CVE-2026-22812 via opencode-ai (>=0.14.7 <=1.0.123)

opencode-ai NPM version =0.14.7, =2.4.0-canary.0ba816b, =0.0.1, =0.1.0, =0.1.9, =0.5.7 Source cves: CVE-2026-22812 Source advisory: OSV:GHSA-VXW4-WV6M-9HHH...