Malicious Package

Overview ts-rand-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview awesome-ts-jest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in ts-rand-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f3c43a89866228b5365b9e318da3ea953bb2c5b7da94136d887359e8e1f07a8 Package presents itself as a random transactions SDK exposing a single API, getTransactionscount. Following that documented usage triggers a hidden...

MAL-2026-14193 Malicious code in ts-rand-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f3c43a89866228b5365b9e318da3ea953bb2c5b7da94136d887359e8e1f07a8 Package presents itself as a random transactions SDK exposing a single API, getTransactionscount. Following that documented usage triggers a hidden...

Uncontrolled Resource Consumption

deepmerge-ts is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to failure to track visited objects or object pairs during recursive merging, which allows an attacker to provide recursive object graphs that trigger infinite recursion, causing a RangeError and potentially...

ANT-2026-CEP8Y9M0 · ffmpeg · Use-After-Free

use-after-free high Severity Claude high · Security research firm - · Maintainer - REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-CEP8Y9M0: avformat/mpegts: reset PES state before JPEG-XS error return In the MPEG-TS demuxer, newpespacket begins transferring ownership of...

CVE-2026-40345

creationtimestamp| type| source ---|---|--- 2026-08-17 14:35:03+00:00| published-proof-of-concept| https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx 2026-08-17 18:00:03+00:00| seen| Telegram/S7eqLraqEg6Kwu3Kw8cANfzCQgkQhswVCeNeKxsnaOowjNQ 2026-08-18...

Exploit for CVE-2026-40345

deepmerge-ts mergeleft.self, right.self - mergeleft.sel...

NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs

NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs vulnerability discovered by ? in WordPress Npm deepmerge-ts versions 8.0.0...

Uncontrolled Recursion

Overview deepmerge-ts is a Deeply merge 2 or more objects respecting type information. Affected versions of this package are vulnerable to Uncontrolled Recursion via the deepmerge and deepmergeInto functions. An attacker can cause a process crash or denial of service by supplying crafted recursiv...

GHSA-GGR8-5VV4-36MX DeepmergeTS has stack exhaustion when merging recursive object graphs

Summary deepmerge and deepmergeInto can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded. Details Record merging is implemented...

DeepmergeTS has stack exhaustion when merging recursive object graphs

Summary deepmerge and deepmergeInto can be crashed with a crafted recursive object graph. When both merged values contain self-references at the same property path, the library recurses until Node throws RangeError: Maximum call stack size exceeded. Details Record merging is implemented...

Uncontrolled Recursion

Overview org.webjars.npm:deepmerge-ts is a Deeply merge 2 or more objects respecting type information. Affected versions of this package are vulnerable to Uncontrolled Recursion via the deepmerge and deepmergeInto functions. An attacker can cause a process crash or denial of service by supplying...

PT-2026-76717

Name of the Vulnerable Software and Affected Versions deepmerge-ts versions prior to 8.0.0 Description The library fails to track visited objects or object pairs during the recursive merging of records. When two input values contain self-references at the same property path, the merge logic...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100363 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: raspberrypi-ts - fix refcount leak in rpitsprobe rpifirmwareget take reference, we need to...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099979)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099979 advisory. In the Linux kernel, the following vulnerability has been resolved: Input: raspberrypi-ts - fix refcount leak in rpitsprobe rpifirmwareget take reference, we need to...

Malicious Package

Overview @ts-apis/ts-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ts-enum-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in ts-enum-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f362b9a6fbb2e117301be8a8195f14b6fa8481e3dcc3b37faff3d6eb111b0070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14015 Malicious code in ts-enum-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f362b9a6fbb2e117301be8a8195f14b6fa8481e3dcc3b37faff3d6eb111b0070 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...