Malicious code in pfp-block-mobile-steps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4b4495333f6f37664594f2e6533842a4d3a317bb98bbc3a467797bb8ec851d7 On require of the package, index.js unconditionally loads shim.js, which selects a payload path based on process.platform/arch linuxx64, linuxarm64,...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

Malicious code in statist-browser-typed-client-jumptaxi.feature.contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 534768cd8d709ca1a5701f182e4e509713821923b6995a2bb868d79b0fdded62 On require of the package index.js loads./vendor at import, vendor.js selects a platform-specific staging path, downloads a binary from a rotated lis...

ROOT-APP-PYPI-CVE-2023-44271 CVE-2023-44271 in pillow - Patched by Root

Root has patched CVE-2023-44271 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-59204 CVE-2026-59204 in pillow - Patched by Root

Root has patched CVE-2026-59204 in the pillow package for Root:PyPI. Multiple fixed versions available...

CVE-2026-71243

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

ROOT-APP-NPM-CVE-2026-6321 CVE-2026-6321 in fast-uri - Patched by Root

Root has patched CVE-2026-6321 in the fast-uri package for Root:npm. Multiple fixed versions available...

CVE-2026-71243 backmeup (npm): OS Command Injection via Backup Option Values

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

EUVD-2026-53316

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

ROOT-APP-NPM-CVE-2016-20018 CVE-2016-20018 in knex - Patched by Root

Root has patched CVE-2016-20018 in the knex package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-55685 CVE-2026-55685 in react-router - Patched by Root

Root has patched CVE-2026-55685 in the react-router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-QWWW-VCR4-C8H2 GHSA-qwww-vcr4-c8h2 in react-router - Patched by Root

Root has patched GHSA-qwww-vcr4-c8h2 in the react-router package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-R28C-9Q8G-F849 GHSA-r28c-9q8g-f849 in postcss - Patched by Root

Root has patched GHSA-r28c-9q8g-f849 in the postcss package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41182 CVE-2026-41182 in langsmith - Patched by Root

Root has patched CVE-2026-41182 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-45134 CVE-2026-45134 in langsmith - Patched by Root

Root has patched CVE-2026-45134 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-F4XH-W4CJ-QXQ8 GHSA-f4xh-w4cj-qxq8 in langsmith - Patched by Root

Root has patched GHSA-f4xh-w4cj-qxq8 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root

Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...

Malicious code in geocode-quick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419 The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment...

Malicious code in datefmt-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787 datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall...

Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...