Malicious code in boxy-fixture-allure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...

JLSEC-2026-107 Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag

The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access equivalent to --allow-env, and writing /proc/self/mem may provide access equivalent t...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...