614196 matches found
CVE-2026-59875 vulnerabilities
Vulnerabilities for packages: graalvm, opensearch-dashboards-fips, gitlab-rails-ce-fips, wazuh-dashboard-fips, prism, opensearch-dashboards, pulumi, sqlpad, actions-runner, saf, wazuh-dashboard, kubeflow-centraldashboard, kibana, code-server, npm, lerna, gitlab-rails-ce...
CVE-2026-59873 vulnerabilities
Vulnerabilities for packages: graalvm, homepage, opensearch-dashboards-fips, gitlab-rails-ce-fips, wazuh-dashboard-fips, prism, opensearch-dashboards, pulumi, sqlpad, actions-runner, saf, wazuh-dashboard, kubeflow-centraldashboard, kibana, code-server, npm, lerna, gitlab-rails-ce...
CVE-2026-59874 vulnerabilities
Vulnerabilities for packages: graalvm, homepage, opensearch-dashboards-fips, gitlab-rails-ce-fips, wazuh-dashboard-fips, prism, opensearch-dashboards, pulumi, sqlpad, actions-runner, saf, wazuh-dashboard, kubeflow-centraldashboard, kibana, code-server, npm, lerna, gitlab-rails-ce...
GHSA-GF2W-JQMQ-FCM8 vulnerabilities
Vulnerabilities for packages: python...
GHSA-9MC4-RQMQ-H467 vulnerabilities
Vulnerabilities for packages: python...
CVE-2026-59875 vulnerabilities
Vulnerabilities for packages: npm, saf, code-server, lerna, pulumi, kubeflow-centraldashboard, sqlpad, prism...
CVE-2026-59871 vulnerabilities
Vulnerabilities for packages: npm, saf, code-server, lerna, pulumi, kubeflow-centraldashboard, sqlpad, prism...
CVE-2026-59873 vulnerabilities
Vulnerabilities for packages: npm, saf, code-server, lerna, pulumi, kubeflow-centraldashboard, sqlpad, prism...
GHSA-3CFQ-4XX4-RMPG vulnerabilities
Vulnerabilities for packages: libssh2...
CVE-2026-55199 vulnerabilities
Vulnerabilities for packages: libssh2...
Malicious code in nodemon-plint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c287effa0f498762ab73bfc0e4428b4d0afbc05435b1613459f9024d0b97927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-10595 Malicious code in nodemon-plint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c287effa0f498762ab73bfc0e4428b4d0afbc05435b1613459f9024d0b97927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in async-mutex-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7df420be80a00abb5efead6e83b37885cc37a347641386c0633719197dcb3dc5 Package published as 'async-mutex-v2' advertises itself as a Promise-based mutex but ships no mutex implementation. The main entry index.js exports...
MAL-2026-10582 Malicious code in async-mutex-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7df420be80a00abb5efead6e83b37885cc37a347641386c0633719197dcb3dc5 Package published as 'async-mutex-v2' advertises itself as a Promise-based mutex but ships no mutex implementation. The main entry index.js exports...
MAL-2026-10589 Malicious code in nodeaxois (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...
MAL-2026-10587 Malicious code in dayjscore (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9b2226f2ebbeccf1bcafbec9c51e2b3f13e3a7712dfc22baa79fbb72393b8a The package's package.json declares scripts.postinstall = "node.init.js", causing.init.js to run automatically on npm install. The script harvests a...
MAL-2026-10584 Malicious code in chalkdevx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e6c8e970ad81ccd02b4725232cbd0d145a20f08e42983097229563e35cac8ad package.json declares a postinstall hook that runs.init.js on npm install. The script enumerates 65 credential and CI environment variables NPMTOKEN,...
MAL-2026-10583 Malicious code in chalkdev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619 chalkdev is a near-empty package index.js exports , 11-byte README whose sole runtime behavior is a postinstall hook that runs .init.js on npm instal...
MAL-2026-10593 Malicious code in twiliobox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a94eb66c6d3f03cf5b4e2e13527b9ab9bcb1ae85e75b62f79f58e225b941970 On npm install, [email protected] runs its declared postinstall script node.init.js, which enumerates credential-shaped environment variables NPMTOKEN,...
MAL-2026-10590 Malicious code in openaiwrapper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...