GHSA-2QPH-QPVM-2QF7 vulnerabilities

Vulnerabilities for packages: sdp-k8s-injector...

CVE-2024-28854 vulnerabilities

Vulnerabilities for packages: sdp-k8s-injector...

MAL-2026-14411 Malicious code in dpg-media-7ehemel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594 npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment...

Malicious code in dpg-media-7ehemel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a904ad03d7041e21fe41a101c6a2db4a6aa3106f7b36394208bb4a5a39ee594 npm package [email protected] executes node index.js from a preinstall lifecycle script that harvests installer identity and environment...

MAL-2026-14410 Malicious code in @temptation.js/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ac41747a5c926627c28c9f1a651df91cd3447b07ca4cafabc1916004d1e70 The package registers a preinstall hook node index.js that runs on npm install and harvests installer-side data: os.hostname, OS username, home...

Malicious code in @temptation.js/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ac41747a5c926627c28c9f1a651df91cd3447b07ca4cafabc1916004d1e70 The package registers a preinstall hook node index.js that runs on npm install and harvests installer-side data: os.hostname, OS username, home...

ROOT-APP-MAVEN-CVE-2026-59642 CVE-2026-59642 in org.bouncycastle:bcpkix-jdk18on - Patched by Root

Root has patched CVE-2026-59642 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2026-59639 CVE-2026-59639 in org.bouncycastle:bcpkix-jdk18on - Patched by Root

Root has patched CVE-2026-59639 in the org.bouncycastle:bcpkix-jdk18on package for Root:Maven. Multiple fixed versions available...

CVE-2026-76845 adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

Malicious code in dext-crate-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e581bed6c9028ebf84b341f914135c1af62bc9b75072f1c511c4c187cb94abfd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dext-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329047f71cd6b35084bea7ed22978ba88e02cb557a5490b6133a70a5a0859a19 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dext-crate-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3becb032c5eb2c6055f81b9fc5dbd5d5c517d1c4028810110bd1b202ec4742e5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in create-json-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed8ecd294b2515f40dbcea497a8a597797b26ca773d6944a3f207249fbbce503 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @blurrydespair/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8 Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require o...

ROOT-APP-MAVEN-CVE-2020-36518 CVE-2020-36518 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-36518 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2020-36184 CVE-2020-36184 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2020-36184 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-31802 CVE-2026-31802 in tar - Patched by Root

Root has patched CVE-2026-31802 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-59874 CVE-2026-59874 in tar - Patched by Root

Root has patched CVE-2026-59874 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-29786 CVE-2026-29786 in tar - Patched by Root

Root has patched CVE-2026-29786 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-11856 CVE-2026-11856 in curl - Patched by Root

Root has patched CVE-2026-11856 in the curl package for Root:Debian:13. Multiple fixed versions available...