@12-apps/app-shell (>=1.0.0, <=4.0.0), @12-apps/auth (>=1.2.0, <=1.22.0) +280 more potentially affected by CVE-2026-73419 via @auth/core (>=0.0.0-manual.fdbc96ab, <=0.41.2)

@auth/core NPM version =0.0.0-manual.fdbc96ab, =1.0.0, =1.2.0, =1.10.0, =0.1.0, =0.0.1, =1.0.0, =0.2.0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-73419 Source advisory: OSV:GHSA-X445-F3H2-J279...

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0to1-builders (0.1.0) +23055 more potentially affected by CVE-2026-35590 via sharp (>=0.4.2, <=0.34.5)

sharp NPM version =0.4.2, =0.1.0, =0.0.0, =0.0.1, =0.0.2, =4.2.0-next.2, =0.0.1, =1.0.0-alpha.1, =1.0.0, =1.0.9, =1.0.0, =0.0.1, =1.225.0, =1.252.0 and more Source cves: CVE-2026-35590 Source advisory: SNYK:JS-SHARP-18184416...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +5 more potentially affected by CVE-2026-16221 via fast-uri (>=3.0.1, <=3.1.2)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =1.25.0, =2.2.0, =2.3.1 Source cves: CVE-2026-16221 Source advisory: SNYK:JS-FASTURI-18021349...

@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.15) +24 more potentially affected by CVE-2026-53496 via exifreader (>=4.1.1, <=4.39.1)

exifreader NPM version =4.1.1, =0.0.5, =0.1.0, =1.18.1-dev.1638815480459, =1.0.2, =2.2.8, =2.1.11, =1.0.6, =0.5.0, =4.10.0, =1.0.0-beta.141, =1.0.0-beta.143 and more Source cves: CVE-2026-53496 Source advisory: OSV:GHSA-G77H-45RF-HCX4...

@0xwork/connect (>=0.1.0, <=0.1.8), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-62218 via openclaw (>=2026.3.22, <=2026.5.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-62218 Source advisory: SNYK:JS-OPENCLAW-18017833...

@0xwork/connect (>=0.1.0, <=0.1.9), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +913 more potentially affected by CVE-2026-59873 via tar (>=7.0.0, <=7.5.18)

tar NPM version =7.0.0, =0.1.0, =0.1.8-fix.3, =0.0.6, =11.0.19, =1.0.0, =1.0.2, =2026.4.23-zh, =0.1.0, =0.1.1, =0.1.1, =2026.4.4, =0.59.0, =0.64.0 - @aivibeclaw/speech-core 2026.6.10 and more Source cves: CVE-2026-59873 Source advisory: SNYK:JS-TAR-17909152...

@agent-native/core (>=0.26.5, <=0.47.1), @agentcorporation/server (>=0.3.3, <=0.3.13) +199 more potentially affected by CVE-2026-53514 via better-auth (>=1.0.0, <=1.6.10)

better-auth NPM version =1.0.0, =0.26.5, =0.3.3, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =1.0.35, =2026.324.0-canary.0, =0.0.2, =2026.501.0, =2026.501.0, =0.1.3, =0.0.7, =1.0.0-canary.2, =1.5.0-beta.13 and more Source cves: CVE-2026-53514 Source advisory: SNYK:JS-BETTERAUTH-17889813...

@devpodio/github-extension (1.0.0), @eclipse-glsp-examples/workflow-theia (>=1.0.0-theia1.27.0, <=1.1.0-next.e29c96e.130) +119 more potentially affected by CVE-2026-10055 via @theia/request (>=1.26.0, <=1.72.3)

@theia/request NPM version =1.26.0, =1.0.0-theia1.27.0, =1.0.0, =0.7.1, =1.58.6, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.57.0-next.37, =1.46.0-next.241, =1.72.3 and more Source cves: CVE-2026-10055 Source advisory: SNYK:JS-THEIAREQUEST-17810719...

@grackle-ai/cli (>=0.72.3, <=0.132.1), @grackle-ai/core (>=0.75.4, <=0.132.1) +7 more potentially affected by unknown CVE via @grackle-ai/auth (>=0.72.3, <=0.132.1)

@grackle-ai/auth NPM version =0.72.3, =0.72.3, =0.75.4, =0.72.3, =0.96.3, =0.99.0, =0.97.0, =0.98.0, =0.72.3, =0.75.1, =0.132.1 Source cves: unknown CVE Source advisory: SNYK:JS-GRACKLEAIAUTH-17817919...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53807 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53807 Source advisory: OSV:GHSA-W5WW-7CHG-MXCQ...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53831 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53831 Source advisory: OSV:GHSA-MHQ8-78PJ-5J79...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53812 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53812 Source advisory: OSV:GHSA-2HFG-4FH4-QP7F...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-53822 via openclaw (>=2026.3.22, <=2026.5.7)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-53822 Source advisory: OSV:GHSA-2J8V-HWGC-X698...

@donmai/core (>=0.9.0, <=0.9.5), @donmai/mcp-server (>=0.9.0, <=0.9.5) +8 more potentially affected by CVE-2026-48816 via @sigstore/verify (3.1.0)

@sigstore/verify NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sigstore/verify and may be impacted: - @donmai/core =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.66 Source cves:...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49987 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49987 Source advisory: OSV:GHSA-9MM9-RQHJ-J5MX...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +130 more potentially affected by CVE-2026-11779 via payload (>=0.8.2, <=4.0.0-internal.9726517)

payload NPM version =0.8.2, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.1, =1.0.1-beta.0, =1.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-11779 Source advisory: SNYK:JS-PAYLOAD-17660977...

Malicious code in rstreams-metrics (npm)

The rstreams-metrics npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

@0xlimao/n8n-nodes-ethereum (>=1.0.0, <=1.0.1), @aayshian/n8n-aisensy-ay19 (0.0.1) +138 more potentially affected by CVE-2026-54314 via @n8n/config (>=2.0.0, <=2.23.0)

@n8n/config NPM version =2.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.3.6, =0.1.1, =0.1.0, =1.0.0, =0.1.4, =0.3.4 and more Source cves: CVE-2026-54314 Source advisory: SNYK:JS-N8NCONFIG-17430992...

@chaibuilder/sdk (>=0.1.0, <=1.2.19), @coderrental/csp-categorytree (>=1.1.0, <=1.1.7) +2 more potentially affected by CVE-2026-55091 via flat-to-nested (>=1.1.0, <=1.1.1)

flat-to-nested NPM version =1.1.0, =0.1.0, =1.1.0, =1.0.17, =1.0.18 - flow-dg-category-module 0.0.0 Source cves: CVE-2026-55091 Source advisory: OSV:GHSA-HP36-V28F-W3R4...

@openinc/parse-server-opendash (>=4.0.12, <=4.0.29) potentially affected by CVE-2026-50008 via parse-server (9.8.0)

parse-server NPM version 9.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - @openinc/parse-server-opendash =4.0.12, =4.0.29 Source cves: CVE-2026-50008 Source advisory: OSV:GHSA-P84R-H6RX-F2XR...