PT-2026-52525

Name of the Vulnerable Software and Affected Versions pnpm versions 11.3.0 through 11.5.2 Description The pnpm stage download command derives a local filename using package name and version fields controlled by the registry. A crafted manifest can lead to a path traversal, allowing an attacker to...

Malicious code in gita-klipo87-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2fb702017fc7d9001414030fd38799636ab2655cc5e71a91bb8a3f23a1628ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...