MAL-2026-6108 Malicious code in @ncurran/sandbox-recon-sys-5f1b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f4f0ce20b0ebc74a6cc6447e493d56421999e17f0f980661c9baab280032850 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6115 Malicious code in npm-sandbox-research-a1b2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd030068356281ae499fe6af7fd86ae10cac9f77f2f3fcc4d2d9abb67750be19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6106 Malicious code in @ncurran/sandbox-recon-9b2d4f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e26a43461da776d8145183e606db9c9bdbfaa1a053e76c44ce1f78ec1364ec1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6109 Malicious code in @ncurran/sandbox-recon-sys-6a3f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 608b0bb395714d269bf26dcde1f7863b0376062eb1b1707f2a7dd4dac279574b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6104 Malicious code in @ncurran/sandbox-recon-7c4e1a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1184134c86ce193b3abfb06949b3ce9ba51711e8e5615405d4f2ab63aa51a89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6110 Malicious code in @ncurran/sandbox-recon-uac-4e7c (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 115efe1e922669b73488b969fea50128ffb8c0b8a5ef462d6c6319feaf1ce578 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6103 Malicious code in @ncurran/dc-selftest-ba0ad4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 945bb6ebb1c34a64499b626b76d65ee3241c5018390eba029b3654bef389786c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-99F9-J8R3-P853 Hermes Agent creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644)

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

CVE-2026-53870

Hermes Agent before 0.16.0 creates responsestore.db and webhooksubscriptions.json with world-readable permissions mode 0o644, exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including...

MAL-2026-6073 Malicious code in @mastra/observability (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d011342f74ef411523da8a4a42af220a5816766b2d519fd8f824ed35f33fdb2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/observability (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d011342f74ef411523da8a4a42af220a5816766b2d519fd8f824ed35f33fdb2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6072 Malicious code in @mastra/loggers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225485064c54423eac85ed05753c97466d46c15d9b59dbe48193b115f538b3b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/loggers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5225485064c54423eac85ed05753c97466d46c15d9b59dbe48193b115f538b3b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6074 Malicious code in @mastra/redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9691125da52a04efba450b4c5dcbebe08a604a54f2e9420d95ce17f782f2728 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9691125da52a04efba450b4c5dcbebe08a604a54f2e9420d95ce17f782f2728 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the POST /api/v1/repos/owner/repo/forks API endpoint, which fails to enforce the required organization repository creation permissions. An attacker can gain administrative control over a new repository within...

Malicious code in scan-only (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a7779ff21d9783e1026e13a7abf65e448c5f3d3d111f3cae539f3690e53a2b4 The CLI binary at bin/scan-only.js, when invoked e.g., via npx scan-only --diagnose, harvests installer-side secrets and ships them to a hardcoded...

CVE-2026-47277

Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo symlinks. The path guard checks only...

Malicious code in sodel-pych (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d67bcaf42f4ef050a6b824dfbc2f711d6820f7b3b1140d211110f390e512fa The package ships several files whose names and contents suggest a non-trivial install-time and runtime footprint: a postinstall script...

MAL-2026-6062 Malicious code in sodel-pych (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d67bcaf42f4ef050a6b824dfbc2f711d6820f7b3b1140d211110f390e512fa The package ships several files whose names and contents suggest a non-trivial install-time and runtime footprint: a postinstall script...