com.simplemobiletools.dialer

This repository does not have a README...

com.eypcnnapps.quickreboot

This repository does not have a README...

Malicious code in some-very-long-package-name (npm)

Source: amazon-inspector 1ce120698c1be7e98866ccdff0987f7b77f53377e525284f311363b79f5ea397 Package ships a postinstall lifecycle hook node beacon.cjs and a top-level require'./beacon.cjs'.fire call in index.js, so both npm install and any require of the package trigger an outbound HTTP POST to the...

Malicious code in some-very-long-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c08ea2abb307f6ecb9a1896fcc3980e9a1eaf8b29044db67cd985654e1db16 The package is a stub whose main module exports a Proxy that returns a no-op for every property access, providing none of the functionality implied b...

MAL-2026-17778 Malicious code in some-very-long-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c08ea2abb307f6ecb9a1896fcc3980e9a1eaf8b29044db67cd985654e1db16 The package is a stub whose main module exports a Proxy that returns a no-op for every property access, providing none of the functionality implied b...

Mobile Security Framework MobSF 4.5.2 Command Injection

Mobile Security Framework MobSF version 4.5.2 contains a command injection issue in Android package-name handling during dynamic-analysis APK retrieval...

Malicious code in fake-package-name (npm)

--- Credit: OpenSSF source...

Malicious code in confidential-package-name (npm)

Source: ossf-package-analysis 22b6e399f6684509440f29b16a20c593cc1aee7a15e87f5263dfe847b6d7850a The OpenSSF Package Analysis project identified 'confidential-package-name' @ 99.9.9 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with...

EUVD-2026-68883

pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install...

Names Can Hurt: Spotting Slopsquatting Risks Caused by Package Name Hallucinations in Local Coding LLMs

When a code generating language model fabricates a Python package name, an adversary who has pre-registered that name on PyPI can convert that hallucination into a supply chain compromise. This event has been termed as 'slopsquatting'. We propose a two layer detector to counter this issue. The...

EUVD-2026-62471

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

JupyterLab: PyPI extension blocklist package-name canonicalization bypass

JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...

BIT-JUPYTERLAB-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

MAL-2026-14175 Malicious code in core-js-gns (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5eadad92952db436b03dd9673b34d203d9296b0913389de2aa0d9fef441631 The package's postinstall hook package.json → node init.js runs an installer-side dropper. init.js gates on developer-machine heuristics presence of...

CVE-2026-73416

A flaw was found in jupyterlab. The PyPI Python Package Index extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. This allows an authenticated user to bypass blocklist restrictions by using an alternative spelling of a...

CVE-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

CVE-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

CVE-2026-73416

This CVE affects JupyterLab (PyPI extension manager) where the blocked_extensions_uris check uses a weaker-than-PyPI normalization, allowing an authenticated user to bypass the blocklist by using a PyPI-equivalent spelling (e.g., JupyterLab.Git for jupyterlab-git). Versions 4.5.0–4.5.10 and 4.6.2...

MAL-2026-13945 Malicious code in core-js-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec43d0c13a26ec0a6e6dacf51f52a66f48c7dbce7f4a00dbcb72a0749fa6b4e3 The package's postinstall script package.json declares "postinstall": "node init.js" performs two hostile actions at install time. First, init.js POS...

MAL-2026-13864 Malicious code in @years18/n8n-nodes-utils-helper-t (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8582b5c27e0823f2431d4069a971d7d106d92f6ddb68bf9b7b443fe98b930ea The package's postinstall script and its main entry index.js, byte-identical to callback.js execute the same payload on npm install and on require. T...