MAL-2026-5430 Malicious code in @sourceflow-uk/sourceflow-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5bcccc37c380ce54f5bfc2bc2311fbefb6ebc3400a397cbc4afc2188fb3c11d package.json declares a dependency ltidisafe whose version specifier is the raw URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz — a...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +28061 more potentially affected by CVE-2026-9277 via shell-quote (>=1.3.3, <=1.8.3)

shell-quote NPM version =1.3.3, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...

@akoskm/create-mcp-server-stdio (>=0.0.5, <=0.0.14), @bazel/create (8.0.2) +43 more potentially affected by CVE-2026-11572 via degit (>=2.1.3, <=2.8.5)

degit NPM version =2.1.3, =0.0.5, =3.0.3, =1.1.0-alpha.0, =1.4.0, =1.0.1, =2.0.5, =1.0.0, =1.5.0, =0.1.0, =17.7.1-alpha.173, =17.7.1-alpha.176, =0.1.1, =1.2.7, =1.3.6 and more Source cves: CVE-2026-11572 Source advisory: OSV:GHSA-77C7-PQ4R-6MCQ...

io.fabric8.examples:fabric-activemq-demo (1.2.0.redhat-133), io.fabric8.mq:camel-amq (1.2.0.redhat-133) +6 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.12.release)

org.springframework:spring-jms MAVEN version 3.2.12.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - io.fabric8.examples:fabric-activemq-demo 1.2.0.redhat-133 - io.fabric8.mq:camel-amq...

capital.scalable:spring-auto-restdocs-core (>=1.0.10, <=1.0.13), cc.catalysts.boot:cat-boot-thymeleaf (>=0.2.13, <=0.2.28) +549 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.11.release)

org.springframework:spring-webmvc MAVEN version 4.3.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - capital.scalable:spring-auto-restdocs-core =1.0.10, =0.2.13, =1.0.5, =1.0.0, =1.0.0,...

com.allanditzel:spring-security-csrf-token-filter (1.1), com.cedarsoftware:json-command-servlet (>=1.0.0, <=1.1.2) +179 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.6.release)

org.springframework:spring-expression MAVEN version 3.2.6.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - com.allanditzel:spring-security-csrf-token-filter 1.1 -...

com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.9-release), com.ahome-it:ahome-tooling-server-hazelcast (>=1.1.4-release, <=1.1.9-release) +10 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.1.release)

org.springframework:spring-jms MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.ahome-it:ahome-tooling-server-core =1.1.4-release, =1.1.4-release, =1.1.4-release,...

org.apache.camel:camel-itest-spring32 (>=2.17.0, <=2.17.7), org.springframework.integration:spring-integration-jms (3.0.8.release) potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.15.release)

org.springframework:spring-jms MAVEN version 3.2.15.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-itest-spring32 =2.17.0, =2.17.7 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +166 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (4.3.0.release)

org.springframework:spring-expression MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

com.assist4j:assist4j-core (1.0.0), com.assist4j:assist4j-data (1.0.0) +258 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.3.13.release)

org.springframework:spring-jms MAVEN version 4.3.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.assist4j:assist4j-core 1.0.0 - com.assist4j:assist4j-data 1.0.0 -...

be.rufer.swisscom.sms:api-client (1.0), ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (0.9) +233 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.1.3.release)

org.springframework:spring-expression MAVEN version 4.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - be.rufer.swisscom.sms:api-client 1.0 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (>=2.0, <=2.2) +348 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.1.release)

org.springframework:spring-expression MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =2.0, =2.0, =2.1.0-release,...

com.github.dnvriend:akka-persistence-query-extensions_2.11 (>=0.0.1, <=0.0.5), com.github.dnvriend:reactive-activemq_2.11 (>=0.0.3, <=0.0.25) +33 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.2.5.release)

org.springframework:spring-jms MAVEN version 3.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - com.github.dnvriend:akka-persistence-query-extensions2.11 =0.0.1, =0.0.3, =2.12.3, =2.12.3,...

au.com.mountain-pass:hyperstate-client (>=1, <=10), au.com.mountain-pass:hyperstate-client-webdriver (>=1, <=10) +519 more potentially affected by CVE-2026-41853 via org.springframework:spring-webmvc (4.3.2.release)

org.springframework:spring-webmvc MAVEN version 4.3.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - au.com.mountain-pass:hyperstate-client =1, =1, =1, =1, =1, =1.0.0-rc, =0.0.26, =0.0.2...

at.porscheinformatik.zanata:zanata-spring (>=1.0.0.release, <=1.1.0.release), ca.appsimulations:jlqninterface (>=1.0.0, <=1.1.0) +1586 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (4.3.13.release)

org.springframework:spring-expression MAVEN version 4.3.13.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.porscheinformatik.zanata:zanata-spring =1.0.0.release, =1.0.0, =1.0.2,...

org.apache.camel:camel-itest-spring40 (>=2.15.0, <=2.15.1), org.neuro4j:spring-jms-adapter (>=3.0.1, <=3.4.1) +3 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (4.0.8.release)

org.springframework:spring-jms MAVEN version 4.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-itest-spring40 =2.15.0, =3.0.1, =1.1.9.release, =1.1.9.release,...

ca.islandora.indexing:islandora-indexing-triplestore (>=0.0.1, <=0.0.2), com.alibaba.compileflow:compileflow (>=1.0.0-rc1, <=1.2.0) +316 more potentially affected by CVE-2026-41851 via org.springframework:spring-expression (3.2.11.release)

org.springframework:spring-expression MAVEN version 3.2.11.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - ca.islandora.indexing:islandora-indexing-triplestore =0.0.1, =1.0.0-rc1,...

ai.ancf.lmos-router:lmos-router-hybrid-spring-boot-starter (0.28.0), ai.ancf.lmos-router:lmos-router-llm-in-spring-cloud-gateway-demo (>=0.2.0, <=0.28.0) +16408 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (>=6.1.0, <=6.1.21)

org.springframework:spring-expression MAVEN version =6.1.0, =0.2.0, =0.1.1, =0.1.1, =0.1.1, =0.1.1, =0.0.4, =0.1.0, =0.1.0, =0.1.0-beta.1, =0.1.0-beta.2 - ai.djl.spring:djl-spring-boot-starter-autoconfigure 0.26 - ai.djl.spring:djl-spring-boot-starter-mxnet-auto 0.26 and more Source cves:...

org.apache.camel:camel-amqp (2.5.0), org.apache.camel:camel-example-cxf (2.5.0) +29 more potentially affected by CVE-2026-41855 via org.springframework:spring-jms (3.0.4.release)

org.springframework:spring-jms MAVEN version 3.0.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-jms and may be impacted: - org.apache.camel:camel-amqp 2.5.0 - org.apache.camel:camel-example-cxf 2.5.0 -...

ai.aletyx.kogito:aletyx-kogito-addons-springboot-dev-console (10.2.0), ai.aletyx.kogito:aletyx-kogito-ai-addons-springboot-adhoc-subprocess (>=0.1.0, <=0.2.0) +19086 more potentially affected by CVE-2026-41850 via org.springframework:spring-expression (>=6.2.0, <=6.2.18)

org.springframework:spring-expression MAVEN version =6.2.0, =0.1.0, =0.1.0, =0.114.0, =0.114.0, =0.114.0, =0.114.0, =0.5.0, =0.8.0, =0.9.0 and more Source cves: CVE-2026-41850 Source advisory: OSV:GHSA-R5W3-XV2F-J59Q...