GHSA-V66C-278H-3VJ4 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-C8MV-CH2P-4GWV vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-FH7W-CWH7-HVQ9 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-JHRP-V2XG-MR29 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-RMV3-P6FW-XH3H vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-6WJ6-669X-MJRF vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-QJ6X-X634-3RC3 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-R2P6-2GJ6-77XG vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15118 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15111 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15109 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15116 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-15129 vulnerabilities

Vulnerabilities for packages: chromium...

MAL-2026-10485 Malicious code in polymarket-stake-kelly-math-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a7da439d70295bc7192ecc100ebdff0b08a601d31aa98dcf20af783ec169a26 The package declares a postinstall hook node scripts/install-check.cjs that reads a remote JSON config from...

MAL-2026-10482 Malicious code in react-icons-svgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ccdc7a601182ae60a4f75d72cb54aef12fbe94cb209625f6f1c9be47b12096 index.js stores base64-encoded literals svgValidateKey, svgValidatePattern that decode to the shell command npm install rollup-plugin-polyfill-handle...

MAL-2026-10484 Malicious code in browser-use-headless (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a85306ba70b361b2851e9e3db9219235556e964e62ad131a7c9760ff63b49b88 The package presents itself as a headless browser-automation helper typosquat of browser-use but contains an appended credential-stealer block. On...

Malicious code in @sectest429/hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d The package advertises a single function module.exports = function helloname but ships a preinstall.js lifecycle script that runs automatically on np...

MAL-2026-10478 Malicious code in @sectest429/hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d The package advertises a single function module.exports = function helloname but ships a preinstall.js lifecycle script that runs automatically on np...

Malicious code in @torbeck/priority-queue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3109ebd719fa91812bd69e50b418b78f2a04c5478924f6ff53054cb798dc937 The package republishes @datastructures-js/priority-queue verbatim — identical README pointing to datastructures-js.info, the original author 'Eyas...

MAL-2026-10473 Malicious code in claude-team-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7e9f6179a67a2904c37bd9cff22174a8c57755972fc878047993c35c03f5544 On install, postinstall.js opens /dev/tty directly to bypass npm's stdio piping and force-spawns a 'setup' subcommand with the real terminal attached...