66 matches found
Malicious code in aws-xray-sdk-node (npm)
The package aws-xray-sdk-node was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in weavedb-sdk-node (npm)
Source: amazon-inspector 59e557cd0501bb17925a19c5d3525fdf18f286b21750a44c0164eb7e165f55d9 package.json declares "preinstall": "./dist/runtime.node", causing npm to execute a 976 KB packed binary on every install. The file uses the .node extension typically reserved for Node.js native addons loade...
@edoday/react-sdk (>=1.2.0, <=1.2.1), weavedb-client (>=0.9.2, <=0.45.4) +5 more potentially affected by unknown CVE via weavedb-base (>=0.9.7, <=0.45.4)
weavedb-base NPM version =0.9.7, =1.2.0, =0.9.2, =0.8.0, =0.21.0, =0.9.0, =0.9.0, =0.45.2 Source cves: unknown CVE Source advisory: GHSA-XJ9G-9FF6-G755...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +3150 more potentially affected by CVE-2026-44902 via @opentelemetry/sdk-node (>=0.10.2, <=0.216.0)
@opentelemetry/sdk-node NPM version =0.10.2, =0.1.0, =0.1.0-dev.00aaa03, =5.0.0, =0.1.1, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.13 and more Source cves: CVE-2026-44902 Source advisory:...
MAL-2026-4725 Malicious code in weavedb-sdk-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59e557cd0501bb17925a19c5d3525fdf18f286b21750a44c0164eb7e165f55d9 package.json declares "preinstall": "./dist/runtime.node", causing npm to execute a 976 KB packed binary on every install. The file uses the .node...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2095 more potentially affected by CVE-2026-44902 via @opentelemetry/sdk-node (>=0.57.0, <=0.216.0)
@opentelemetry/sdk-node NPM version =0.57.0, =0.1.0, =0.1.0-dev.00aaa03, =0.1.1, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.3.4-0, =0.1.0, =0.4.0, =5.0.1-staging.f17326334 and more Source cves: CVE-2026-44902 Source...
0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +2095 more potentially affected by CVE-2026-44902 via @opentelemetry/sdk-node (>=0.57.0, <=0.216.0)
@opentelemetry/sdk-node NPM version =0.57.0, =0.1.0, =0.1.0-dev.00aaa03, =0.1.1, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.3.4-0, =0.1.0, =0.4.0, =5.0.1-staging.f17326334 and more Source cves: CVE-2026-44902 Source...
Prometheus exporter process crash via malformed HTTP request
Summary A single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint default 0.0.0.0:9464 has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. You...
MAL-2026-2802 Malicious code in synthetics-sdk-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f901ab2d37659ee8585c20804e368b185c14c0e5fc49e51a3148fb439b728bad The package synthetics-sdk-node was found to contain malicious code...
Malicious code in synthetics-sdk-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f901ab2d37659ee8585c20804e368b185c14c0e5fc49e51a3148fb439b728bad The package synthetics-sdk-node was found to contain malicious code...
MAL-2026-2075 Malicious code in @emilgroup/document-sdk-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ce75300fb34ac856a75eba90e2d05ccf97af99f2b5f9b3b907635991b3dcf95 The package @emilgroup/document-sdk-node was found to contain malicious code. Source: ghsa-malware...
Malware in @emilgroup/document-sdk-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in @emilgroup/task-sdk-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2026-2079 Malicious code in @emilgroup/task-sdk-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10e089e1ab5774c571e6a0f5c650a044301456e9558509c051d38dce51eac73 The package @emilgroup/task-sdk-node was found to contain malicious code. Source: ghsa-malware...
Malware in @emilgroup/public-api-sdk-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in @emilgroup/commission-sdk-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in @emilgroup/setting-sdk-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2026-2059 Malicious code in @emilgroup/setting-sdk-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd7001495cf0c7d9cbe60f2b406b90b4fc34d7a8fc8477c45780cefddf26e28b The package @emilgroup/setting-sdk-node was found to contain malicious code. Source: ghsa-malware...
Malware in @emilgroup/changelog-sdk-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in @emilgroup/tenant-sdk-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...