@vaadin/react-components-pro (>=24.10.0, <=24.10.6), @vaadin/vaadin (>=24.10.0, <=24.10.10) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.10.0, <=24.10.6)

@vaadin/charts NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.10 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (>=24.5.0, <=24.7.12), @vaadin/vaadin (>=24.5.0, <=24.8.0-alpha1) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.5.0, <=24.7.12)

@vaadin/charts NPM version =24.5.0, =24.5.0, =24.5.0, =24.8.0-alpha1 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (25.3.0), @vaadin/vaadin (25.3.0) potentially affected by CVE-2026-107588 via @vaadin/charts (25.3.0)

@vaadin/charts NPM version 25.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on @vaadin/charts and may be impacted: - @vaadin/react-components-pro 25.3.0 - @vaadin/vaadin 25.3.0 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691...

@vaadin/react-components-pro (>=24.8.0, <=24.9.18), @vaadin/vaadin (>=24.8.0-rc2, <=24.10.0-alpha1) potentially affected by CVE-2026-107588 via @vaadin/charts (>=24.8.0, <=24.9.18)

@vaadin/charts NPM version =24.8.0, =24.8.0, =24.8.0-rc2, =24.10.0-alpha1 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (>=25.0.0, <=25.2.13), @vaadin/vaadin (>=25.0.0, <=25.3.0-alpha3) potentially affected by CVE-2026-107588 via @vaadin/charts (>=25.0.0, <=25.2.13)

@vaadin/charts NPM version =25.0.0, =25.0.0, =25.0.0, =25.3.0-alpha3 Source cves: CVE-2026-107588 Source advisory: SNYK:JS-VAADINCHARTS-21691580...

@vaadin/react-components-pro (>=25.2.0, <=25.2.8), @vaadin/vaadin (>=25.2.0, <=25.3.0-alpha3) potentially affected by CVE-2026-91860 via @vaadin/charts (>=25.2.0, <=25.2.8)

@vaadin/charts NPM version =25.2.0, =25.2.0, =25.2.0, =25.3.0-alpha3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/react-components-pro (>=25.0.0, <=25.1.11), @vaadin/vaadin (>=25.0.0, <=25.1.11) potentially affected by CVE-2026-91860 via @vaadin/charts (>=25.0.0, <=25.1.11)

@vaadin/charts NPM version =25.0.0, =25.0.0, =25.0.0, =25.1.11 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@digital-realty/grid (1.2.4-IXUAT-11104.552907), @vaadin/hilla-react-crud (>=24.10.0, <=24.10.8) +4 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=24.10.0, <=24.10.4)

@vaadin/component-base NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/react-components-pro (>=24.10.0, <=24.10.4), @vaadin/vaadin (>=24.10.0, <=24.10.9) potentially affected by CVE-2026-91860 via @vaadin/charts (>=24.10.0, <=24.10.4)

@vaadin/charts NPM version =24.10.0, =24.10.0, =24.10.0, =24.10.9 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@hilla/react-components (>=1.3.0-alpha3, <=1.6.4), @majinno/vaadin-components-import (>=1.0.1, <=1.0.16) +4 more potentially affected by CVE-2026-91860 via @vaadin/charts (>=23.0.0, <=23.6.4)

@vaadin/charts NPM version =23.0.0, =1.3.0-alpha3, =1.0.1, =23.0.0, =23.0.14, =1.0.2, =1.0.2, =1.0.3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@hilla/react-components (>=2.0.0, <=2.4.0-alpha2), @hilla/react-crud (>=2.3.0-beta1, <=2.5.8) +7 more potentially affected by CVE-2026-91860 via @vaadin/charts (>=24.0.0, <=24.9.17)

@vaadin/charts NPM version =24.0.0, =2.0.0, =2.3.0-beta1, =2.3.0-alpha1, =24.0.0, =24.4.0-alpha10, =24.4.0-alpha12, =24.4.0-alpha10, =24.0.0-rc3, =24.10.0-alpha1 - hilla-admin-react 1.0.0 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

@vaadin/hilla-react-crud (>=25.2.0, <=25.3.0-alpha2), @vaadin/react-components (>=25.2.0, <=25.2.8) +3 more potentially affected by CVE-2026-91860 via @vaadin/component-base (>=25.2.0, <=25.2.8)

@vaadin/component-base NPM version =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.2.0, =25.3.0-alpha3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

Malicious code in github-react-components (npm)

The package github-react-components was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in f34th3r-react-components (npm)

The package f34th3r-react-components was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in eos-react-components (npm)

--- Credit: OpenSSF source...

Malicious code in cfa-react-components (npm)

Source: ossf-package-analysis aac7ddc598f480a5c87bd28d65a6fc762b5c9ce46b72934eabe3760b49f11a36 The OpenSSF Package Analysis project identified 'cfa-react-components' @ 2.8.8 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in acme-react-components (npm)

The package acme-react-components was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in accounts-react-components (npm)

The package accounts-react-components was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in @antv/s2-react-components (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malware in @ntnx/nx-react-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...