Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data exposing process environment values, in getOptionsFromRootManifest.ts, which expands $VAR placeholders in the httpProxy, httpsProxy, and noProxy settings read from a repository-controlle...

GHSA-VX52-2968-3VC6 pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Summary pnpm expands $VAR environment placeholders in the httpProxy / httpsProxy / noProxy settings read from a project's pnpm-workspace.yaml. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs pnpm install in can route all install...

CLEANSTART-2026-ZB55594 Security fixes in secrets-store-csi-driver-provider-gcp 1.17.0-r2

Package secrets-store-csi-driver-provider-gcp version 1.17.0-r2 fixes 20 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-PP35477 Security fixes in secrets-store-csi-driver-provider-gcp 1.17.0-r1

Package secrets-store-csi-driver-provider-gcp version 1.17.0-r1 fixes 20 vulnerabilities: CVE-2026-42508, CVE-2026-39835, CVE-2026-46598, CVE-2026-39828, CVE-2026-39829...

CLEANSTART-2026-ZD57800 Security fixes in external-secrets-operator 2.9.0-r0

Package external-secrets-operator version 2.9.0-r0 fixes 1 vulnerabilities: ghsa-gcjh-h69q-9w9g...

Malicious code in @yane88/listary-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd784784bedda93c768e67f6604062febe7761cb1ff3b1fb2178ad075aef10d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15664 Malicious code in @yane88/workbuddy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00baaa53d63c0bababb9db20aa5e86149da604834a5761b827edd2f936178c91 At npm install time, @yane88/[email protected]'s postinstall script pulls three sibling npm packages @yane88/workbuddy-01, -02, -03, each shipping a...

MAL-2026-15657 Malicious code in @yane88/listary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6260eed43832753ea0c07338c5b555cbe97792c6d22c086f83c7b97e60c6ff8c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15658 Malicious code in @yane88/listary-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd784784bedda93c768e67f6604062febe7761cb1ff3b1fb2178ad075aef10d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/workbuddy-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1067553b82d11f9e2a38c4d59dd3b450f722d5572fc8bb43765d5093f68cc23f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15649 Malicious code in @yane88/hexhub-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a628c35399f2993b111f79396b198c542374b19367ccb6062c5f59f2b61dfdbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15663 Malicious code in @yane88/term-reqable-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c0e2129fbf1e7a2da4c71b24bbd38abade289a0f9aa576bacefb53566046cc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @yane88/term-reqable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bede455ffb8df248983dc819abe214260d4d70582e54f60c9cf99e974f3bafa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15659 Malicious code in @yane88/listary-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c557592d2b0b567ac07c3a66d9cc87f2bf6efb6b5646356c5d58afff3391f79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/listary-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c557592d2b0b567ac07c3a66d9cc87f2bf6efb6b5646356c5d58afff3391f79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15662 Malicious code in @yane88/term-reqable-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dd1d25c85b0febc391c9ca33af1d4bbbec959413342470f159562f40ed9bd07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @yane88/workbuddy-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dbb87f4a9b5e5482d4c8fdc2c448905f4a4df65feb64c3100385c616cf5470a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/ripgrep-win (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c09d2a7b42fb9d603ab4b8d0a2afedab22f28e00295c870c4f140ef7dbec78ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15666 Malicious code in @yane88/workbuddy-02 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1067553b82d11f9e2a38c4d59dd3b450f722d5572fc8bb43765d5093f68cc23f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @yane88/workbuddy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00baaa53d63c0bababb9db20aa5e86149da604834a5761b827edd2f936178c91 At npm install time, @yane88/[email protected]'s postinstall script pulls three sibling npm packages @yane88/workbuddy-01, -02, -03, each shipping a...