@fedify/amqp (0.2.0-dev.12), @fedify/botkit (>=0.3.0-dev.125, <=0.4.0-dev.175) +3 more potentially affected by CVE-2026-50131 via @fedify/fedify (>=1.5.0, <=1.9.2)

@fedify/fedify NPM version =1.5.0, =0.3.0-dev.125, =0.4.0-dev.167, =0.3.0-dev.20, =0.4.0-dev.18, =0.4.0 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYFEDIFY-17954864...

@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +5 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.0.0, <=2.0.18)

@fedify/vocab-runtime NPM version =2.0.0, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0-dev.1757, =2.0.0-dev.12, =2.0.0-dev.158, =2.0.0-dev.0, =2.0.0-dev.0, =2.0.18 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYVOCABRUNTIME-17954863...

@fedify/botkit (>=0.4.0-dev.182, <=0.4.0-dev.183), @fedify/botkit-sqlite (>=0.4.0-dev.182, <=0.4.0-dev.183) +1 more potentially affected by CVE-2026-50131 via @fedify/fedify (>=2.0.0, <=2.0.18)

@fedify/fedify NPM version =2.0.0, =0.4.0-dev.182, =0.4.0-dev.182, =2.0.0-dev.1757, =2.0.18 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYFEDIFY-17954864...

@fedify/cli (>=2.2.0-dev.898, <=2.2.3) potentially affected by CVE-2026-50131 via @fedify/fedify (>=2.2.0, <=2.2.3-dev.1098)

@fedify/fedify NPM version =2.2.0, =2.2.0-dev.898, =2.2.3 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYFEDIFY-17954864...

@fedify/botkit (>=0.4.0-dev.184, <=0.5.0-dev.205), @fedify/botkit-sqlite (>=0.4.0-dev.184, <=0.5.0-dev.205) +5 more potentially affected by CVE-2026-50131 via @fedify/vocab-runtime (>=2.1.0, <=2.1.14)

@fedify/vocab-runtime NPM version =2.1.0, =0.4.0-dev.184, =0.4.0-dev.184, =2.1.0, =2.1.0-dev.403, =2.1.0-dev.403, =2.1.0-dev.403, =2.1.0-dev.403, =2.1.14 Source cves: CVE-2026-50131 Source advisory: SNYK:JS-FEDIFYVOCABRUNTIME-17954863...

@fedify/botkit (>=0.4.0-dev.177, <=0.4.0-dev.181), @fedify/botkit-sqlite (>=0.4.0-dev.177, <=0.4.0-dev.181) potentially affected by CVE-2026-50131 via @fedify/fedify (1.10.0)

@fedify/fedify NPM version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on @fedify/fedify and may be impacted: - @fedify/botkit =0.4.0-dev.177, =0.4.0-dev.177, =0.4.0-dev.181 Source cves: CVE-2026-50131 Source advisory:...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +609 more potentially affected by CVE-2026-11417 via aws-cdk-lib (>=2.0.0, <=2.245.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-11417 Source advisory: SNYK:JS-AWSCDKLIB-1729590...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +1368 more potentially affected by CVE-2025-71329 via image-size (>=2.0.0, <=2.0.2)

image-size NPM version =2.0.0, =0.1.1, =0.0.1-251008.90016, =2.11.1, =0.0.1, =0.0.32-beta.12, =1.0.0, =1.0.0-alpha.12, =1.0.0-alpha.12, =1.0.0-alpha.203, =1.0.0-alpha.12, =1.0.0-alpha.203, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-71329 Source advisory: OSV:GHSA-5P2G-FCMC-QVQQ...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +1368 more potentially affected by CVE-2025-71330 via image-size (>=2.0.0, <=2.0.2)

image-size NPM version =2.0.0, =0.1.1, =0.0.1-251008.90016, =2.11.1, =0.0.1, =0.0.32-beta.12, =1.0.0, =1.0.0-alpha.12, =1.0.0-alpha.12, =1.0.0-alpha.203, =1.0.0-alpha.12, =1.0.0-alpha.203, =0.1.0, =0.1.0, =0.2.0 and more Source cves: CVE-2025-71330 Source advisory: OSV:GHSA-W3RX-R6R6-PGPR...

02vue_toast_demo (>=1.0.1, <=1.0.4), 06-tekbooks (0.1.0) +31720 more potentially affected by CVE-2025-71319 +1 more via image-size (>=0.0.16, <=2.0.2)

image-size NPM version =0.0.16, =1.0.1, =0.0.2, =0.0.3, =1.0.0-alpha.1, =1.0.5, =5.0.0, =2.3.0, =0.2.0, =2.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2025-71319, CVE-2025-71329 Source advisory: SNYK:JS-IMAGESIZE-17295814...

org.webjars.npm:datauri (>=1.1.0, <=2.0.0), org.webjars.npm:image-thumbnail (1.0.15) +1 more potentially affected by CVE-2025-71319 +1 more via org.webjars.npm:image-size (>=0.5.5, <=2.0.0-alpha.1)

org.webjars.npm:image-size MAVEN version =0.5.5, =1.1.0, =2.7.1, =2.7.2 Source cves: CVE-2025-71319, CVE-2025-71329 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17295815...

org.webjars.npm:datauri (>=1.1.0, <=2.0.0), org.webjars.npm:image-thumbnail (1.0.15) +1 more potentially affected by CVE-2025-71330 via org.webjars.npm:image-size (>=0.5.5, <=2.0.0-alpha.1)

org.webjars.npm:image-size MAVEN version =0.5.5, =1.1.0, =2.7.1, =2.7.2 Source cves: CVE-2025-71330 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17295817...

02vue_toast_demo (>=1.0.1, <=1.0.4), 06-tekbooks (0.1.0) +31720 more potentially affected by CVE-2025-71330 via image-size (>=0.0.16, <=2.0.2)

image-size NPM version =0.0.16, =1.0.1, =0.0.2, =0.0.3, =1.0.0-alpha.1, =1.0.5, =5.0.0, =2.3.0, =0.2.0, =2.0.0, =1.0.0, =1.0.6 and more Source cves: CVE-2025-71330 Source advisory: SNYK:JS-IMAGESIZE-17295816...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0, <=1.3.2) potentially affected by CVE-2026-48037 via @hulumi/baseline (>=1.3.1, <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48037 Source advisory: SNYK:JS-HULUMIBASELINE-17660551...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0, <=1.3.2) potentially affected by CVE-2026-48037 via @hulumi/baseline (>=1.3.1, <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48037 Source advisory: OSV:GHSA-CJ8G-PRCM-MFG5...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0, <=1.3.2) potentially affected by CVE-2026-48035 via @hulumi/baseline (>=1.3.1, <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48035 Source advisory: SNYK:JS-HULUMIBASELINE-17660549...

@hulumi/platform-patterns (>=0.0.0-bootstrap.0, <=1.3.2) potentially affected by CVE-2026-48035 via @hulumi/baseline (>=1.3.1, <=1.3.2)

@hulumi/baseline NPM version =1.3.1, =0.0.0-bootstrap.0, =1.3.2 Source cves: CVE-2026-48035 Source advisory: OSV:GHSA-2MXR-P26X-MJ73...

MAL-2026-5437 Malicious code in commons-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b9fb701d18bde61d1dc783f0575a4d83bc0eba2653bd0832d0fc26bc9e85b48 [email protected] is an empty placeholder package index.js exports , description/author blank, version bumped to 99.9.1 — the classic...

Malicious code in commons-ui-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b9fb701d18bde61d1dc783f0575a4d83bc0eba2653bd0832d0fc26bc9e85b48 [email protected] is an empty placeholder package index.js exports , description/author blank, version bumped to 99.9.1 — the classic...

MAL-2026-5447 Malicious code in localization-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf143361939feffe7099c14acc7cf41a401681481e932e15d6054dde49e88f94 [email protected] is an empty shell package: index.js is module.exports = and package.json has no description or author. Its dependencies...