612343 matches found
Malicious code in polyprompt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52da21b792fba3cc472cb67f1a5b445786802d67b6cf81b45409acdab8724c17 lib/report.js resolves the installer's git/GitHub email through gh api user/emails, git config, npm config, and environment variables, then POSTs a...
Malicious code in goldenflow-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8634bdafa282ed99ee4b3edd205599207ac2f52a4d150d4bdd0f9b69326f64d lib/report.js in [email protected] collects installer-side data using node's os, childprocess, and fs modules os.hostname, os.userInfo,...
Malicious code in routerbase-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f468779704fb38dd80ed26eabb01f4afdfef486ebb645d99fc07c36dcb479cf The package published as 'routerbase-mcp' declares a bin named 'install-email-research' and ships lib/report.js which collects the installer's email...
MAL-2026-11463 Malicious code in goldenflow-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8634bdafa282ed99ee4b3edd205599207ac2f52a4d150d4bdd0f9b69326f64d lib/report.js in [email protected] collects installer-side data using node's os, childprocess, and fs modules os.hostname, os.userInfo,...
Malicious code in ai-backup-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5603e10be681ac5a86236edb1ce9cf53615e02867d7ff230a392b8363d7220b The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/GitHub email via gh api, git...
Malicious code in iac-scanner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90ccff89d665d28ad35ad8c285427a56af2c0d5862b432a7de604a99a0358d9 lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, executes local commands via execSync,...
MAL-2026-11467 Malicious code in iac-scanner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90ccff89d665d28ad35ad8c285427a56af2c0d5862b432a7de604a99a0358d9 lib/report.js imports childprocess, fs, https, and os, collects host identity via os.hostname and os.userInfo, executes local commands via execSync,...
MAL-2026-11454 Malicious code in ai-backup-script (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5603e10be681ac5a86236edb1ce9cf53615e02867d7ff230a392b8363d7220b The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/GitHub email via gh api, git...
golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input
A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...
MAL-2026-11434 Malicious code in @404c3s4r/lodash (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5358fa9c178ab559f9837f8cc08744caf0eb8a45dcfaa1c3a8d26a72d859a74a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-WRJC-X8RR-H8H6 vulnerabilities
Vulnerabilities for packages: vitess, keycloak...
GHSA-CHX6-HX7R-MCP5 vulnerabilities
Vulnerabilities for packages: vitess...
CVE-2026-53669 vulnerabilities
Vulnerabilities for packages: vitess, keycloak...
GHSA-337J-9HXR-RHXG vulnerabilities
Vulnerabilities for packages: vitess, keycloak...
GHSA-R9MR-M37C-5FR3 vulnerabilities
Vulnerabilities for packages: mlflow...
GHSA-6P8H-3WGX-97GF vulnerabilities
Vulnerabilities for packages: mlflow...
GHSA-VJC4-5QP5-M44J vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
CVE-2026-59198 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...