Malicious code in francium-web-visitors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72629df67c0b81a1d120987aca534bd8096a0cbb2a9898a327a2dc2d1b8a0a49 The package francium-web-visitors was found to contain malicious code. Source: ghsa-malware...

Malicious code in francium-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f204d22648cb65e36ba9d225f45edaac3240ad8b638e40aa87397ebd20bc9bde The package francium-ui was found to contain malicious code. Source: ghsa-malware 9d6cf557fe491bb7638bf2b12ca8587adf51f6f3f105002a08544b42b567ee7d An...

MAL-2026-242 Malicious code in francium-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bbfe7cfa0e201004579dc73a60307dbd93e6507801d3dd767b689cb748535c1 The package francium-utils was found to contain malicious code. Source: ghsa-malware 36e968a97c914ae6c1bf4fb980564d69546cc92105d1be341f56c933ec2caa12...

MAL-2026-241 Malicious code in francium-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f204d22648cb65e36ba9d225f45edaac3240ad8b638e40aa87397ebd20bc9bde The package francium-ui was found to contain malicious code. Source: ghsa-malware 9d6cf557fe491bb7638bf2b12ca8587adf51f6f3f105002a08544b42b567ee7d An...

Malicious code in extended-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1daed3089b5ef77daaeecaac9fe17f36363fd47d3dbe2814f5902c7ec3e61a74 The package extended-path was found to contain malicious code. Source: ghsa-malware 69c860714616f6ecc1c5b9d066780ece372fd1346ffce61438ecc12c9a98b30b...

MAL-2026-240 Malicious code in extended-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1daed3089b5ef77daaeecaac9fe17f36363fd47d3dbe2814f5902c7ec3e61a74 The package extended-path was found to contain malicious code. Source: ghsa-malware 69c860714616f6ecc1c5b9d066780ece372fd1346ffce61438ecc12c9a98b30b...

MAL-2026-239 Malicious code in chai-as-enhanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb34c187e4750d1e5a6dc3c297a953d8089f054d74e4cac7667532d81b72ea8 The package chai-as-enhanced was found to contain malicious code. Source: ghsa-malware cb4ee9056898577e40bbef5e13e321597457852aa84f71886d4aef75898669...

Malicious code in chai-as-enhanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb34c187e4750d1e5a6dc3c297a953d8089f054d74e4cac7667532d81b72ea8 The package chai-as-enhanced was found to contain malicious code. Source: ghsa-malware cb4ee9056898577e40bbef5e13e321597457852aa84f71886d4aef75898669...

Malicious code in paytmsiddlewaree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1efaf28ec793c8856900b61d75973e6fb48c4c8d7081740ca4cb3fe5baa755f The package paytmsiddlewaree was found to contain malicious code. Source: ghsa-malware 0834762f3450b3984c00a9fa79f7b78cf3676dc0b91f86fd53b26649e9b991...

MAL-2026-238 Malicious code in paytmsiddlewaree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1efaf28ec793c8856900b61d75973e6fb48c4c8d7081740ca4cb3fe5baa755f The package paytmsiddlewaree was found to contain malicious code. Source: ghsa-malware 0834762f3450b3984c00a9fa79f7b78cf3676dc0b91f86fd53b26649e9b991...

CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...

CVE-2026-22771

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

CVE-2026-22771 Envoy Extension Policy lua scripts injection causes arbitrary command execution

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

MAL-2026-235 Malicious code in tailwindcss-animate-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 150bc7ffcbd255578f8dc6e8ce8781a01e97dcdc6a57436976f6b08beb371807 The package tailwindcss-animate-tool was found to contain malicious code. Source: ghsa-malware...

MAL-2026-218 Malicious code in express-sessions-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50976a5a79aa6e9a71eee66f3a74059d86a7620d670cf19ad43c9eb3619b0c2e The package express-sessions-id was found to contain malicious code. Source: ghsa-malware...

Malicious code in express-sessions-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50976a5a79aa6e9a71eee66f3a74059d86a7620d670cf19ad43c9eb3619b0c2e The package express-sessions-id was found to contain malicious code. Source: ghsa-malware...

Malicious code in cors-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 718e28ab42e6dd02cb599b331659e8f24be94c7d3b4e2dc859f1e09c34b7a822 The package cors-base was found to contain malicious code. Source: ghsa-malware 672c2f33d6521094e055da17d375ba21b3d35b58cd67db660f502e8f0512684d Any...

MAL-2026-216 Malicious code in cors-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 718e28ab42e6dd02cb599b331659e8f24be94c7d3b4e2dc859f1e09c34b7a822 The package cors-base was found to contain malicious code. Source: ghsa-malware 672c2f33d6521094e055da17d375ba21b3d35b58cd67db660f502e8f0512684d Any...

MAL-2026-213 Malicious code in @maxcointech/simple-string-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ce5c423557091383b99bcc8612d954b43dd380d8979019493ee390f7bfa5a30 The package @maxcointech/simple-string-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-230 Malicious code in passport-google-auth-token (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e78391289ff7e26ec937eb7519688992d2497e503ba4ca396d2c2a23b71235 The package passport-google-auth-token was found to contain malicious code. Source: ghsa-malware...