MAL-2026-10047 Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

Malicious code in chai-as-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84d908f9158abcdd631b569f812b06cb59a1788f2435dd05a47fd39021d60a49 Package name impersonates the popular chai-as-promised testing library and the README is copied from pino. The advertised usage chai.usechaiAsStaged...

MAL-2026-10055 Malicious code in chain-chai-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 655c64cb99f74a3b96f1b5e1d0102ce0c756e63368a5ca252e70e49e98f346b3 [email protected] impersonates the pino logging library README badge links to npm/pino, exports module.exports.pino = middleware, and ships file...

MAL-2026-10052 Malicious code in chai-promised-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ddaac3e93ed2e5d968816cf3153b2ab1878580bb9ee65ec3ec1acdca41dc018 Package masquerades as a chai-as-promised plugin / pino logger README and exports copied from pino, including module.exports.pino = middleware but on...

Malicious code in chain-chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with...

MAL-2026-10056 Malicious code in chain-chai-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with...

Malicious code in chai-as-serialized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e48e8980927471640c6573406d988d1a4361759f14a952da36c5daa1c9fd3c The package's main entry index.js spawns a detached node child process running lib/initializeCaller.js as a side effect of invoking the exported...

MAL-2026-10048 Malicious code in chai-as-thread (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69f1826d6866410cdfe11e20cff630d3f0118d48c0cc9f697297aa64d29b341 On require, the package spawns a detached node child that runs lib/initializeCaller.js. That script decodes a base64-obscured URL...

MAL-2026-10040 Malicious code in chai-as-balanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 562ae39db73c30faea0a6d84cda0fe0b68d60d7bfa863f769edcdb620e30b0a1 chai-as-balanced is a typosquat of chai-as-promised also impersonating pino via README/badges/exports that ships a remote code execution dropper...

MAL-2026-10051 Malicious code in chai-deflect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4328eb627063ce40813ae27e3cb7ec1a967d17aa6c2bf045f0083d42e09352ea On require'chai-deflect', index.js top-level invokes launchDeflectBootstrap which detaches a child process running lib/caller.js. caller.js issues an...

Malicious code in chai-as-sharpened (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e8e5d81ba59ee1353535523ea62b29c07de8d6a5cc50745a471696d80576a On require, the package spawns a detached background node process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL...

MAL-2026-10045 Malicious code in chai-as-sharpened (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 854e8e5d81ba59ee1353535523ea62b29c07de8d6a5cc50745a471696d80576a On require, the package spawns a detached background node process running lib/initializeCaller.js. That script base64-decodes a hardcoded URL...

Malicious code in chai-defender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f276305fd5e43b60bbfd1048d8792ef7f72734c28cfe533d368c0fc199a0fe On require'chai-defender', index.js invokes launchDeflectBootstrap which spawns a detached background node process running lib/caller.js. That proces...

Malicious code in tailwind-animate-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd43366b04ea80c2244079c09602623af157ce00cba9ae1837005b97ffe44bdb The package presents itself as a Tailwind CSS animation plugin and reproduces the legitimate tailwindcss-animate source including its original author...

ROOT-APP-PYPI-CVE-2026-22702 CVE-2026-22702 in rootio-virtualenv - Patched by Root

Root has patched CVE-2026-22702 in the rootio-virtualenv package for Root:PyPI. Multiple fixed versions available...

Malicious code in txs-builder-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55bb13d76ebc74c36f68dd219079500d0bdb60e4bc07f8089eefbcde91bbdeac The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10021 Malicious code in txs-builder-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55bb13d76ebc74c36f68dd219079500d0bdb60e4bc07f8089eefbcde91bbdeac The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

EUVD-2026-42599

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...