MAL-2026-5307 Malicious code in classwind-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d208ce1f57568dc50d9f83887bbedec09115c38282da9b66ae3b2b0045d1cb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in classwind-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d208ce1f57568dc50d9f83887bbedec09115c38282da9b66ae3b2b0045d1cb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in nodemon-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51b598671d8b4d96e826035c56685f7064e10dbcf7cf150e7ab4b2bd9194ad9a Package is published as nodemon-lint but its package.json, README, bin name nodemon, homepage nodemon.io, and source tree are a verbatim copy of Remy...

Malicious code in regexp-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9828b4712ac404ec6f143f9c3115eb73ccd4418bab9cb17327ae325d488954e1 regexp-ts masquerades as the pino logger description, keywords, and module.exports.pino export but is actually a remote-code-execution loader. When a...

MAL-2026-5309 Malicious code in nodemon-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51b598671d8b4d96e826035c56685f7064e10dbcf7cf150e7ab4b2bd9194ad9a Package is published as nodemon-lint but its package.json, README, bin name nodemon, homepage nodemon.io, and source tree are a verbatim copy of Remy...

MAL-2026-5310 Malicious code in regexp-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9828b4712ac404ec6f143f9c3115eb73ccd4418bab9cb17327ae325d488954e1 regexp-ts masquerades as the pino logger description, keywords, and module.exports.pino export but is actually a remote-code-execution loader. When a...

Malicious code in chai-mocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e65359853241724a1b519599469dadfcd2b32674455db9fe5284cb7553a5ddf4 The package masquerades as a pino-style logger middleware but is a remote code loader. When the exported middleware is invoked, index.js spawns a...

MAL-2026-5308 Malicious code in nodemon-copack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad79a82314fcc935b1dbdcb12ca1c413af27877e51058a02665471744f2bcd7a The package is published as 'nodemon-copack' but its package.json wholesale impersonates the legitimate nodemon project: homepage is set to...

PYSEC-0000-CVE-2026-45758

Guardrails AI is a Python framework that helps build AI applications. On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of guardrails-ai 0.10.1 to PyPI. Aany user who installed guardrails-ai==0.10.1 from PyPI on May 11, 2026 may be affected. Security...

CVE-2026-45758

CVE-2026-45758 affects Guardrails AI (Python framework). A malicious PyPI release, guardrails-ai==0.10.1, was published on 2026-05-11. Security telemetry reports no observed requests to Guardrails AI infrastructure from 0.10.1 and no data exfiltration evidence, but affected users should act. The ...

CVE-2026-9133

Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme arn:aws-debug:file accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the...

Malicious code in reactvora (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1cfcb3bd27816a88e8b3dd4f1fac5c0378232af112bf70a452056a637ce7d131 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in glyphr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc5a7daf8ce7e35afeab46185779066154602b910011e68f5241df91f164756e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5269 Malicious code in glyphr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc5a7daf8ce7e35afeab46185779066154602b910011e68f5241df91f164756e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ulid-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3976f115506c13c7fae459afc6ad381e64043c4b8ca394a115763baa3d182c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5268 Malicious code in ulid-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e3976f115506c13c7fae459afc6ad381e64043c4b8ca394a115763baa3d182c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Supply chain compromise via malicious @cap-js/openapi

Impact On May 19, 2026, a compromised version of @cap-js/[email protected] was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine npm tokens, cloud provider credentials, SSH keys,...

GHSA-JPVJ-WPMJ-H7RV Supply chain compromise via malicious @cap-js/openapi

Impact On May 19, 2026, a compromised version of @cap-js/[email protected] was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credentials accessible on that machine npm tokens, cloud provider credentials, SSH keys,...

MAL-2026-5187 Malicious code in supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa2bdcc065a6d4c2b1512f8b68fed22618050c0435c12890c74a2f1405c62093 Withdrawn Advisory This advisory has been withdrawn because the malware detection was a false positive. This link is maintained to preserve external...

Malicious code in supabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ffc0b5a7cfe173533053ac607e28d5e000c963fc1fd706bd9eedf57902e11c1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...