CVE-2026-47900 Stored XSS via Unsanitized Plugin Metadata in Logseq

Logseq is vulnerable to a stored cross-site scripting XSS. A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file, which is rendered using "innerHTML" without proper sanitization, allowing the execution of arbitrary code in the privileged host context...

Malicious code in platform-tempo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1c69e098c3ebeb2876b746523bea0220034b429f58e0a55683f0ee2c8776cd [email protected] declares a preinstall hook that runs poc.js on every npm install. The script collects host identity os.hostname, whoami /all /...

Malicious code in muaddib-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8eea5d3ed390c4c82b5bfa89ac220f1d424fcaebe70fe71bbbe3bce66f0f48f package.json declares "loadash": "^1.0.0" as a runtime dependency. loadash is a well-known typosquat of lodash and is never required or imported...

MAL-2026-4508 Malicious code in cdk-insights (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa41acb776dbedfe93c37899783a5e54b78017ac31576c798a27eae6b9e9ec89 The package contains code in dist/entry.js and dist/index.js that invokes npm publish programmatically combined with writeFileSync operations — the...

GHSA-RG65-45M7-HQ57 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

Summary A Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process. Details The vulnerable...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the browser field in package.json during the build process. An attacker can access arbitrary files on the server filesystem by publishing a specially crafted npm package that remaps module paths to locations...

PT-2026-40543

Name of the Vulnerable Software and Affected Versions esm.sh versions 137 and earlier Description A Local File Inclusion LFI issue exists in the esbuild plugin's handling of the browser field within the package.json file. An attacker can publish a malicious npm package that leverages ../ sequence...

GHSA-W3X5-7C4C-66P9 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Summary An unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files e.g., security.json,...

CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

Malicious code in neptune-middleware-mongoose-neptunology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d0a7212482567b4ff70ad523ee9502116475db634fa180bfd66e4025e91737e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-soap-request-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4475336a5a70cb1e641daf750eece75d4e129c72b58ce76a12e6f8b504a07c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-writable-webpack-cosmogenic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d97564ab9fc4db43f4230b9d93ccc412d62ff1b73b25e6ee7eeca8c3f4298df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ganymede-server-test-warp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d617783d03884b64271ec7efcb054e628005fbdab4733a1866ceff8e38cc8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-geochronology-element-ui-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b2fbd4a4d8c5dac51c3818c36571c2e2edb4ecd33469ce0e9a4d8cca5ce837d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phylogenetics-fork-tectonic-cosmology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20cd04db7ff79d34415c4910ccf5f498e218ce9c415f6d4a1e893027ad764142 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-chalk-middleware-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5456f60ff4b15c35d27afbffb27cbe1a99bfed860e26c0f7ecd263251301e09b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-cli-nightwatch-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4ae5ae48dc55180eb76cf505e37d133d5e836a3f4246eaf1b4fdf5e063f5a2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jasmine-metalsmith-schema-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a67d95657794543c0c975eb63112589e29b6bcfdff3feed460227a8b21843de3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in relay-yaml-markdown-cosmicsilence (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804d65b350c1f98add4c04d9c11ee7b1b0bc7976d3ed0fec988f95918a1482b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fusion-farout-centaurus-metabolomics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2140688c53dbf3ddf8362b2fcb5efa17784ba7b517e493646a526609e0bff85e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...