@forgeax/game (>=0.3.0, <=0.3.10), @huiliyi37/cordis-plugin-loader (>=0.2.0, <=0.8.0) +9 more potentially affected by CVE-2026-82393 via pnpm (>=11.5.3, <=11.7.0)

pnpm NPM version =11.5.3, =0.3.0, =0.2.0, =0.1.2, =0.1.13, =2.2.0, =2.2.12 Source cves: CVE-2026-82393 Source advisory: OSV:GHSA-VQ4V-J7R6-JQ4M...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-82393 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-82393 Source advisory: OSV:GHSA-VQ4V-J7R6-JQ4M...

EUVD-2026-68883

pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install...

Malicious Package

Overview arif-sate10-riris is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview company-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview @stellarshift/token-units is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

ROOT-APP-NPM-CVE-2026-27606 CVE-2026-27606 in rollup - Patched by Root

Root has patched CVE-2026-27606 in the rollup package for Root:npm. Multiple fixed versions available...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-101043 via pnpm (>=10.8.1, <=10.33.2)

pnpm NPM version =10.8.1, =0.1.0, =1.1.1, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-101043 Source advisory: OSV:GHSA-VX52-2968-3VC6...

SUSE CVE-2026-82392

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...

Malicious Package

Overview algol-dione-markdown-io is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview alita-poke97 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @baipiaodajun/reverseproxy-fm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-90551

Summary A crafted lockfile alias could reach several install-time filesystem joins. With --trust-lockfile or a frozen lockfile, traversal segments could create links outside the intended project or node modules boundary. This patch validates dependency names and every virtual-store slot before...

CVE-2026-82393

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...

ROOT-APP-NPM-CVE-2026-1526 CVE-2026-1526 in undici - Patched by Root

Root has patched CVE-2026-1526 in the undici package for Root:npm. Multiple fixed versions available...

pmg v0.27.0

Package Manager Guard PMG Block malicious packages before they install. Why PMG? Developers and AI coding agents install packages every day. Each npm install or pip install executes thousands of lines of code that nobody reviews. Recent compromises in popular ecosystems: Mini Shai-Hulud - 300+...

Unity Linux 20.1070e Security Update: rpm (UTSA-2026-104949)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104949 advisory. A flaw was found in the RPM Package Manager RPM. A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB...

MAL-2026-15446 Malicious code in secure-test-browser-w3hnz5rz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5bd88bab18937f57d80af5b89b0555866effad706132d1812db678b1ceeff8e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview 3layerdipstackbndk47 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview 3layerdipstackn2nce is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...