1045 matches found
Malicious code in npmjs_solc-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b789c7234e3c391e6e2f6359d87f873205fb341c1bf186194815b16d53c7fa71 The package.json defines a postinstall lifecycle hook that invokes childprocess.exec to run curl -s...
MAL-2026-3613 Malicious code in aoflcorp (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bfc014b9e60bb1abb58d948abcf31112dd4c160ab8416317476f3c67c2e84d49 The OpenSSF Package Analysis project identified 'aoflcorp' @ 0.0.1 npm as malicious. It is considered malicious because: - The package...
Malicious code in post-purchase-bundler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a33aa69ef958573a786f3db208d8ee335829e14009d1fdafecbc842ed493b8b The package post-purchase-bundler was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in mw-filesystem-events-nodream (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3da27e815b33bf88dc4fb31bc8b5558501b65ded9de77aab08e7ae785c2c38b The package mw-filesystem-events-nodream was found to contain malicious code. Source: ossf-package-analysis...
OPENSUSE-SU-2026:10741-1 go1.26-1.26.3-1.1 on GA media
These are all security issues fixed in the go1.26-1.26.3-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2025-63706
NPM package next-npm-version1.0.1 is vulnerable to Command injection...
CVE-2025-63706
NPM package next-npm-version1.0.1 is vulnerable to Command injection...
@netlify/agent-runner-cli (>=1.83.1, <=1.94.0), feishu-claude-bot (0.1.0) +1 more potentially affected by CVE-2026-40068 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.81)
@anthropic-ai/claude-code NPM version =2.1.63, =1.83.1, =1.2.2, =1.2.3 Source cves: CVE-2026-40068 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-16301567...
OPENSUSE-SU-2026:10599-1 cacti-1.2.30+git306.82d5aef5-1.1 on GA media
These are all security issues fixed in the cacti-1.2.30+git306.82d5aef5-1.1 package on the GA media of openSUSE Tumbleweed...
1router (>=0.3.96, <=1.0.2), 3d-bin-packing-ts (>=1.0.0, <=1.0.1) +7718 more potentially affected by CVE-2026-41907 via uuid (>=12.0.0, <=13.0.2)
uuid NPM version =12.0.0, =0.3.96, =1.0.0, =2.1.0, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =0.0.1, =0.3.0, =0.4.0, =0.2.0, =0.2.1 - @0xcurvy/curvy-mcp 0.1.0 and more Source cves: CVE-2026-41907 Source advisory: SNYK:JS-UUID-16133035...
@cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6), mikr0 (0.1.10) potentially affected by CVE-2026-33808 via @fastify/express (>=4.0.1, <=4.0.2)
@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-33808 Source advisory: OSV:GHSA-6HW5-45GM-FJ88...
OPENSUSE-SU-2026:10562-1 flannel-0.28.4-1.1 on GA media
These are all security issues fixed in the flannel-0.28.4-1.1 package on the GA media of openSUSE Tumbleweed...
Defense in Depth update for NuGet Client
Impact This update adds validation of the package ID and version during package download, in addition to the existing package signature validation. Patches NuGet The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched: |Affected versions|Patched...
@saltcorn/cli (>=1.5.0-beta.0, <=1.5.4), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.4) potentially affected by CVE-2026-40163 via @saltcorn/server (>=1.5.0, <=1.5.4)
@saltcorn/server NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.4 Source cves: CVE-2026-40163 Source advisory: OSV:GHSA-32PV-MPQG-H292...
@frontmcp/adapters (>=0.5.0, <=1.0.3), frontmcp (0.5.0) potentially affected by CVE-2026-39885 via mcp-from-openapi (>=2.0.0, <=2.1.2)
mcp-from-openapi NPM version =2.0.0, =0.5.0, =1.0.3 - frontmcp 0.5.0 Source cves: CVE-2026-39885 Source advisory: OSV:GHSA-V6PH-XCQ9-QXXJ...
@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +5 more potentially affected by CVE-2026-34148 via @fedify/vocab-runtime (>=2.0.0, <=2.0.7-pr.639.14)
@fedify/vocab-runtime NPM version =2.0.0, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0-dev.1757, =2.0.0-dev.12, =2.0.0-dev.158, =2.0.0-dev.0, =2.0.0-dev.0, =2.0.7 Source cves: CVE-2026-34148 Source advisory: OSV:GHSA-GM9M-GWC4-HWGP...
@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-34769 via electron (>=39.0.0, <=39.2.7)
electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....
MAL-2026-2443 Malicious code in exprrrress (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3605883655f4870250aaab1c630151c6264e54521d1a711a088871de1fe5ea5 The package exprrrress was found to contain malicious code. Source: ossf-package-analysis...
@acmekit/acmekit-oas-cli (>=2.13.1, <=2.13.94), @acmekit/cli (>=2.13.1, <=2.13.94) +90 more potentially affected by CVE-2026-34221 via @mikro-orm/core (>=6.0.0, <=6.6.9-dev.6)
@mikro-orm/core NPM version =6.0.0, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =0.1.29, =0.1.29, =0.5.0, =6.0.0-alpha.1, =2.3.1, =2.4.7 and more Source cves: CVE-2026-34221 Source advisory: OSV:GHSA-QPFV-44F3-QQX6...