@n8n/computer-use (>=0.2.0, <=0.9.0), @n8n/fs-proxy (>=0.1.0-rc1, <=0.1.0) potentially affected by CVE-2026-54309 via @n8n/mcp-browser (>=0.1.0, <=0.8.0)

@n8n/mcp-browser NPM version =0.1.0, =0.2.0, =0.1.0-rc1, =0.1.0 Source cves: CVE-2026-54309 Source advisory: SNYK:JS-N8NMCPBROWSER-17753475...

@0xlimao/n8n-nodes-ethereum (>=1.0.0, <=1.0.1), @aayshian/n8n-aisensy-ay19 (0.0.1) +132 more potentially affected by CVE-2026-54314 via @n8n/config (>=2.0.0, <=2.23.0)

@n8n/config NPM version =2.0.0, =1.0.0, =0.0.1, =1.0.0, =0.0.1, =0.0.1, =0.3.6, =0.1.1, =0.1.0, =1.0.0, =0.1.4, =1.1.3, =1.1.6 and more Source cves: CVE-2026-54314 Source advisory: SNYK:JS-N8NCONFIG-17430992...

Malicious code in ts-sudo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a6e18b2d6bef04dd8377fac8d9b20e5545f1ec39875fdd308adf118b6f319d1 The package publishes under the name ts-sudo but ships a verbatim copy of the big.js v7.0.1 source big.js, big.mjs along with big.js's description,...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.5.2) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0, <=26.5.2)

@actual-app/web NPM version =26.1.0, =26.1.0-nightly.20251204, =26.5.2 Source cves: CVE-2026-50179 Source advisory: SNYK:JS-ACTUALAPPWEB-17818134...

@activepieces/piece-actualbudget (>=0.1.5, <=0.1.9), @actual-app/api (>=26.4.0-nightly.20260317, <=26.5.2) +4 more potentially affected by CVE-2026-50179 via @actual-app/core (>=26.4.0, <=26.5.2)

@actual-app/core NPM version =26.4.0, =0.1.5, =26.4.0-nightly.20260317, =26.4.0-nightly.20260319, =0.1.5, =26.5.1, =26.5.2 Source cves: CVE-2026-50179 Source advisory: SNYK:JS-ACTUALAPPCORE-17818137...

@activepieces/piece-actualbudget (>=0.1.5, <=0.1.9), @actual-app/cli (>=26.4.0-nightly.20260319, <=26.5.2) +5 more potentially affected by CVE-2026-50179 via @actual-app/api (>=26.1.0, <=26.5.2)

@actual-app/api NPM version =26.1.0, =0.1.5, =26.4.0-nightly.20260319, =0.4.4, =0.1.5, =26.1.1, =26.5.2 Source cves: CVE-2026-50179 Source advisory: SNYK:JS-ACTUALAPPAPI-17818135...

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by CVE-2026-54353 via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-54353 Source advisory: SNYK:JS-BUDIBASEBACKENDCORE-17675454...

budibase (>=0.0.3, <=0.0.31) potentially affected by CVE-2026-54352 via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-54352 Source advisory: SNYK:JS-BUDIBASESERVER-17660566...

budibase (>=0.0.3, <=0.0.31) potentially affected by CVE-2026-50137 via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-50137 Source advisory: SNYK:JS-BUDIBASESERVER-17660564...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +20 more potentially affected by CVE-2026-56697 via nuxt (>=4.0.0-rc.0, <=4.4.6)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-56697 Source advisory: SNYK:JS-NUXT-17430976...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +90 more potentially affected by CVE-2026-56697 via nuxt (>=3.0.0, <=3.20.1)

nuxt NPM version =3.0.0, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-56697 Source advisory: SNYK:JS-NUXT-17430976...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @base_/cli (>=1.0.6, <=1.0.29) +90 more potentially affected by CVE-2026-56698 via nuxt (>=3.0.0, <=3.20.1)

nuxt NPM version =3.0.0, =1.0.1, =1.0.6, =1.0.6, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.1.3, =1.0.0-29304822.f444f03, =4.0.3, =0.1.0, =8.0.0, =0.3.14, =9.8.3-rc.1, =10.0.2-rc.4 and more Source cves: CVE-2026-56698 Source advisory: SNYK:JS-NUXT-17430978...

@bloggrify/bento (>=3.0.0, <=3.0.1), @bloggrify/core (>=3.0.0, <=3.1.2) +20 more potentially affected by CVE-2026-56698 via nuxt (>=4.0.0-rc.0, <=4.4.6)

nuxt NPM version =4.0.0-rc.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =1.0.3, =10.0.2-rc.5, =1.1.11, =1.0.4, =0.4.5, =0.0.0, =1.1.0, =3.0.0-dev.27, =4.3.6 and more Source cves: CVE-2026-56698 Source advisory: SNYK:JS-NUXT-17430978...

budibase (>=0.0.3, <=0.0.31) potentially affected by CVE-2026-50136 via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-50136 Source advisory: SNYK:JS-BUDIBASESERVER-17660568...

budibase (>=0.0.3, <=0.0.31) potentially affected by CVE-2026-50132 via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-50132 Source advisory: SNYK:JS-BUDIBASESERVER-17660567...

@budibase/backend-core (>=0.0.999-alpha.30, <=3.2.26), @budibase/bbui (>=0.0.999-alpha.30, <=3.2.26) +9 more potentially affected by CVE-2026-48170 via scim-patch (>=0.7.1, <=0.8.3)

scim-patch NPM version =0.7.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =1.0.11, =1.2.1 Source cves: CVE-2026-48170 Source advisory: SNYK:JS-SCIMPATCH-17818138...

@budibase/backend-core (>=0.0.999-alpha.30, <=3.2.26), @budibase/bbui (>=0.0.999-alpha.30, <=3.2.26) +9 more potentially affected by CVE-2026-48170 via scim-patch (>=0.7.1, <=0.8.3)

scim-patch NPM version =0.7.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =1.0.11, =1.2.1 Source cves: CVE-2026-48170 Source advisory: OSV:GHSA-9M6G-WC8R-Q59C...

@activepieces/piece-actualbudget (>=0.1.5, <=0.1.9), @actual-app/api (>=26.4.0-nightly.20260317, <=26.5.2) +4 more potentially affected by CVE-2026-46672 via @actual-app/core (>=26.4.0, <=26.5.2)

@actual-app/core NPM version =26.4.0, =0.1.5, =26.4.0-nightly.20260317, =26.4.0-nightly.20260319, =0.1.5, =26.5.1, =26.5.2 Source cves: CVE-2026-46672 Source advisory: SNYK:JS-ACTUALAPPCORE-17818141...

Malicious code in node-fetch-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78aef0d64a7d761d2987d27aea462083425e5692475cd81332b7a3152c754308 On Windows, scripts/postinstall.js XOR-decodes a hardcoded C2 host node22.lunes.host:3258, authenticates with a 5-minute rolling HMAC-SHA256 token,...

actix-remote (0.1.0), agnostic (>=0.2.5, <=0.2.6) +264 more potentially affected by CVE-2026-25800 via quinn-proto (>=0.2.0, <=0.11.9)

quinn-proto CARGO version =0.2.0, =0.2.5, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.5.0, =2.0.0, =0.2.3, =0.2.11 and more Source cves: CVE-2026-25800 Source advisory: OSV:RUSTSEC-2026-0185...