CVE-2026-16735

The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...

EUVD-2025-176964

Malicious code in proxima-dotenv-safe-carpo-release-it npm...

EUVD-2025-176708

Malicious code in release-it-nova-orbit-figures npm...

EUVD-2025-176714

Malicious code in release-it-apollo-norma-vuepress npm...

EUVD-2025-177121

Malicious code in plutology-release-it-despina-arcturus npm...

MAL-2025-189168 Malicious code in release-it-perseus-ini-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 104971ab1956bef5ba298bf575f621a9701915460abbdf6ed5d42771db7e9dfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175501

Malicious code in xenon-release-it-telesto-jabbah npm...

EUVD-2025-178555

Malicious code in helmet-release-it-enceladus-figures npm...

EUVD-2025-177833

Malicious code in mini-css-extract-plugin-paleoecology-redis-release-it npm...

EUVD-2025-179873

Malicious code in carpo-release-it-oberon-halley npm...

EUVD-2025-176713

Malicious code in release-it-biogeochemistry-geoarchaeology-protractor npm...

EUVD-2025-178836

Malicious code in framework-release-it-fornax-non-blocking npm...

EUVD-2025-176517

Malicious code in saturnology-astroinformatics-release-it-test npm...

EUVD-2025-176707

Malicious code in release-it-perseus-ini-node-config npm...

EUVD-2025-176554

Malicious code in sagitta-schema-release-it-husky npm...

EUVD-2025-176712

Malicious code in release-it-indus-promise-xml npm...

EUVD-2025-177753

Malicious code in morgan-sass-loader-release-it-quark npm...

EUVD-2025-178975

Malicious code in exoplanet-titan-repository-release-it npm...

EUVD-2025-180065

Malicious code in biohacking-release-it-augmentedreality-janus npm...

MAL-2025-185950 Malicious code in bunyan-release-it-carpo-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10a0f1e12655c75f70e2c1d052cca1e4b0508a72ebf895e2f00f3b0db2b3a712 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...