605400 matches found
ROOT-APP-NPM-GHSA-R28C-9Q8G-F849 GHSA-r28c-9q8g-f849 in postcss - Patched by Root
Root has patched GHSA-r28c-9q8g-f849 in the postcss package for Root:npm. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-41182 CVE-2026-41182 in langsmith - Patched by Root
Root has patched CVE-2026-41182 in the langsmith package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-45134 CVE-2026-45134 in langsmith - Patched by Root
Root has patched CVE-2026-45134 in the langsmith package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-F4XH-W4CJ-QXQ8 GHSA-f4xh-w4cj-qxq8 in langsmith - Patched by Root
Root has patched GHSA-f4xh-w4cj-qxq8 in the langsmith package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root
Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...
Malicious code in geocode-quick (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419 The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment...
Malicious code in datefmt-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addca973f3384757b9ff2e00e5becd70e509ef5233c4cd2dc6ce73019b467787 datefmt-pro presents itself as a date formatting utility, but its actual behavior is an install-time reconnaissance beacon. The scripts.postinstall...
Malicious code in stellarfix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...
MAL-2026-12216 Malicious code in stellarfix (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...
Malicious code in bigops-voximplant (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e20e151930946a17e9bea02eb51c760264c27138792955452acc4231196ceaae On require of bigops-voximplant, index.js loads ext.js which downloads an OS/arch-specific binary from Cloudflare Workers subdomains whose hostnames...
GHSA-F7VP-7XGX-4W4R vulnerabilities
Vulnerabilities for packages: nextcloud-server, privatebin...
ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in langchain - Patched by Root
Root has patched GHSA-gr75-jv2w-4656 in the langchain package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-14257 CVE-2026-14257 in brace-expansion - Patched by Root
Root has patched CVE-2026-14257 in the brace-expansion package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-5889 CVE-2025-5889 in brace-expansion - Patched by Root
Root has patched CVE-2025-5889 in the brace-expansion package for Root:npm. Multiple fixed versions available...
MAL-2026-12085 Malicious code in @wethenorth12/bip39-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4fe167500fb5cab9e31d00a5239bf7ce46ba4205b4c6c044367f424d3285687 Package presents itself as a drop-in replacement for the popular bip39 library but ships a credential stealer in its main entry. On require, the modu...
MAL-2026-12113 Malicious code in python-bitcoinlib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfb9c83260c4fb83a678636e1e1c028f2aff3e3c0a0ac13728cfa2056a13389f This npm package, published under the well-known PyPI name python-bitcoinlib, ships a postinstall.js lifecycle script that runs automatically on npm...
Malicious code in alipclutch-baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81b0a0abb82a50d7f1228c5094619ccaca0223ca767731d2a91f926f04682c1f This package is a fork of the Baileys WhatsApp library. lib/Socket/messages-send.js constructs a network destination via...
ROOT-APP-NPM-CVE-2026-59892 CVE-2026-59892 in @opentelemetry/propagator-jaeger - Patched by Root
Root has patched CVE-2026-59892 in the @opentelemetry/propagator-jaeger package for Root:npm. Multiple fixed versions available...