Malicious code in classbreeze-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e19daf4f946816f5ba3c6e592eacc980861b281c6752b738de57fdd31f49279d The package masquerades as a Tailwind plugin: README and the top of src/index.js are a verbatim clone of @tailwindcss/typography...

Malicious code in cache-compat-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fc75889476bd737b302c856fb1d2da1b263a93786bc27fed3978c3eb0584cd The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

MAL-2026-5878 Malicious code in cache-compat-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fc75889476bd737b302c856fb1d2da1b263a93786bc27fed3978c3eb0584cd The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +304 more potentially affected by CVE-2026-53632 via launch-editor (>=2.2.1, <=2.13.2)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-53632 Source advisory: OSV:GHSA-V6WH-96G9-6WX3...

CVE-2026-49875

A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band OOB external entity resolution, a type of XML External Entity XXE vulnerability. A...

MAL-2026-5748 Malicious code in chai-utils-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64edd573a9e5fdef8dcde78f5b0c9fa00521f232b886be838104741d1e0535f7 Package name 'chai-utils-test' impersonates the popular 'chai' assertion library and ships a cloned chai source tree. The declared main index.js call...

CVE-2026-49875 Apache CXF: XML External Entity (XXE) Injection in W3CMultiSchemaFactory and EndpointReferenceUtils

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band OOB external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue...

PT-2026-48844

Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.2.2 Apache CXF versions prior to 4.1.7 Description The EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the required JAXP hardening configurations. This allows for...

Malicious Package

Overview mm-ts-utils-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-5669 Malicious code in mm-ts-utils-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f5526f66eb7799c34080dc4e5f938decfa90924772556b159a26eaa3b1c4eb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mm-ts-utils-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f5526f66eb7799c34080dc4e5f938decfa90924772556b159a26eaa3b1c4eb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview nw-demo-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview auth0-templates-scripts-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in nw-demo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0c784f9f2bc00678e2648cce9c110ad5084c595b42f80e086bc8dbfbe034359 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5511 Malicious code in nw-demo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f0c784f9f2bc00678e2648cce9c110ad5084c595b42f80e086bc8dbfbe034359 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview coinbase-wallet-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in fhirproxy-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cf847121f4bfed32bc5679a40b64c1338b142af75823ef9583944a7ae7b5a On npm install via the prepare lifecycle hook and many other lifecycle aliases and on require, index.js performs broad reconnaissance and exfiltratio...

MAL-2026-5460 Malicious code in fhirproxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96e092973bad8e995bdec34000e45943e0be59996e84f181ee4bee9cd423f8eb [email protected] is a thin loader package whose only behavior is to pull and execute the dependency fhirproxy-utils. package.json declares both...

MAL-2026-5353 Malicious code in crypto-utils-7 (npm)

Crypto/SSH/wallet stealer, blockchain-helper-0/web3-tools-9 campaign sibling c960/c961. postinstall scripts/postinstall.js auto-execs, src/index.js harvests /.ssh/idrsa+wallet keys/seeds+env, self-labels "CRYPTO STEALER", exfils to IDENTICAL Telegram bot 8227918239 chat 6433587894 not rotated...

MAL-2026-5307 Malicious code in classwind-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d208ce1f57568dc50d9f83887bbedec09115c38282da9b66ae3b2b0045d1cb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...