Malicious Package

Overview snap-queue is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview wurlshowdata is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview no-fun is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in @cartradetech/example-package (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16492 Malicious code in @cartradetech/example-package (npm)

--- -= Per source details. Do not edit below this line.=-...

ROOT-APP-NPM-GHSA-F88M-G3JW-G9CJ GHSA-f88m-g3jw-g9cj in sharp - Patched by Root

Root has patched GHSA-f88m-g3jw-g9cj in the sharp package for Root:npm. Multiple fixed versions available...

CVE-2026-63278

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

CVE-2026-63278

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

yggdrasil-worker-package-manager security update

An update is available for yggdrasil-worker-package-manager. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list yggdrasil-worker-package-manager is a simple packag...

RLSA-2026:69099 Important: yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that matc...

ROOT-APP-NPM-GHSA-MWV6-3258-Q52C GHSA-mwv6-3258-q52c in next - Patched by Root

Root has patched GHSA-mwv6-3258-q52c in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-553733 AIKIDO-2026-553733 in next - Patched by Root

Root has patched AIKIDO-2026-553733 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-59471 CVE-2025-59471 in next - Patched by Root

Root has patched CVE-2025-59471 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-Q4GF-8MX6-V5V3 GHSA-q4gf-8mx6-v5v3 in next - Patched by Root

Root has patched GHSA-q4gf-8mx6-v5v3 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10756 AIKIDO-2026-10756 in next - Patched by Root

Root has patched AIKIDO-2026-10756 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-H25M-26QC-WCJF GHSA-h25m-26qc-wcjf in next - Patched by Root

Root has patched GHSA-h25m-26qc-wcjf in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-55173 CVE-2025-55173 in next - Patched by Root

Root has patched CVE-2025-55173 in the next package for Root:npm. Multiple fixed versions available...

CVE-2026-63278 Package URLs can be used to exfiltrate arbitrary INI file values and environment variables

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

EUVD-2026-84357

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...

CVE-2026-63278 Package URLs can be used to exfiltrate arbitrary INI file values and environment variables

URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise every way of naming the package content...