bdy (>=1.7.46-dev, <=1.18.26-stage), buddy-tunnel (>=1.3.19-dev, <=1.7.45-dev) potentially affected by CVE-2026-53486 via @xhmikosr/decompress (10.0.1)

@xhmikosr/decompress NPM version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @xhmikosr/decompress and may be impacted: - bdy =1.7.46-dev, =1.3.19-dev, =1.7.45-dev Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

@jupyterlab/pullrequests (>=2.0.0-alpha.0, <=3.0.2) potentially affected by CVE-2026-54527 via @jupyterlab/git (>=0.30.0, <=0.40.0)

@jupyterlab/git NPM version =0.30.0, =2.0.0-alpha.0, =3.0.2 Source cves: CVE-2026-54527 Source advisory: SNYK:JS-JUPYTERLABGIT-17391473...

dbgate-serve (>=7.1.3-alpha.3, <=7.1.8), dbmodel (>=7.1.3-alpha.3, <=7.1.8) potentially affected by CVE-2026-48017 via dbgate-api (>=7.1.3-alpha.3, <=7.1.8-alpha.7)

dbgate-api NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.8 Source cves: CVE-2026-48017 Source advisory: OSV:GHSA-HV83-GGC4-V385...

@saltcorn/cli (>=1.5.0-beta.0, <=1.5.5), @saltcorn/mobile-builder (>=1.5.0-beta.0, <=1.5.5) potentially affected by CVE-2026-41478 via @saltcorn/mobile-app (>=1.5.0, <=1.5.5-beta.0)

@saltcorn/mobile-app NPM version =1.5.0, =1.5.0-beta.0, =1.5.0-beta.0, =1.5.5 Source cves: CVE-2026-41478 Source advisory: SNYK:JS-SALTCORNMOBILEAPP-16110990...

@0xyy/elpis (>=1.0.0, <=1.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1522 more potentially affected by CVE-2026-27959 via koa (>=2.0.0, <=2.16.3)

koa NPM version =2.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.0.0-alpha.1, =5.1.3 - @ahua0920/elpis 1.0.0 and more Source cves: CVE-2026-27959 Source advisory: OSV:GHSA-7GCC-R8M5-44QM...

@c0va23/react-router-dev (7.8.3-alpha.2), @orange-js/vite (>=0.0.0-1ae0b37, <=0.0.0-fff5d2d) +9 more potentially affected by CVE-2025-55183 +2 more via @vitejs/plugin-rsc (>=0.4.11, <=0.5.2)

@vitejs/plugin-rsc NPM version =0.4.11, =0.0.0-1ae0b37, =0.0.0-experimental-14dc7c1, =0.0.0-pr-32412-sha-076721d1, =1.0.2, =0.0.1, =0.0.1-alpha.0, =1.0.0, =0.0.0-experimental-64e35ee-20250807, =0.24.0-alpha.0, =0.27.2 Source cves: CVE-2025-55183, CVE-2025-55184, CVE-2025-67779 Source advisory:...

Malicious code in violent-orange-canid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13cc6abefb612e96583bd5a78a5ab3834f1ed1b2b9cfeb5a682fc0568a67e3c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

@0xbigboss/vite-plugin-web-extension (>=5.2.0, <=5.4.0), @58860ed6ffd9e897/gold-finger-extension (1.0.2) +55 more potentially affected by CVE-2025-55164 via content-security-policy-parser (>=0.1.1, <=0.5.0)

content-security-policy-parser NPM version =0.1.1, =5.2.0, =2.13.1-next.0, =2.12.1-canary.3354, =2.12.1-canary.3354, =2.12.5-beta.0, =0.84.3, =0.0.0-experimental-15dcc54, =0.0.0-experimental-4515339, =0.0.0-experimental-2cd2b9e, =0.0.0-experimental-15dcc54, =0.0.0-experimental-15dcc54,...

@cyanheads/git-mcp-server (>=2.0.10, <=2.1.0), @dsazz/mcp-confluence (0.2.0) +34 more potentially affected by CVE-2025-49596 via @modelcontextprotocol/inspector (>=0.2.7, <=0.13.0)

@modelcontextprotocol/inspector NPM version =0.2.7, =2.0.10, =1.0.1, =0.0.0-alpha.0, =1.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2025-49596 Source advisory: OSV:GHSA-7F8R-222P-6F5G...

directus (>=11.0.0, <=11.0.2) potentially affected by CVE-2024-45596 via @directus/api (>=22.0.0, <=22.1.1)

@directus/api NPM version =22.0.0, =11.0.0, =11.0.2 Source cves: CVE-2024-45596 Source advisory: OSV:GHSA-CFF8-X7JV-4FM8...

@aurora-is-near/intents-swap-widget (>=3.17.2, <=7.21.0), @aurora-is-near/intents-swap-widget-standalone (>=6.0.0, <=7.21.0) +16 more potentially affected by CVE-2024-30253 via @solana/web3.js (1.68.0)

@solana/web3.js NPM version 1.68.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @aurora-is-near/intents-swap-widget =3.17.2, =6.0.0, =0.17.1, =1.0.33, =2.18.0, =0.2.3, =0.9.0, =0.9.0, =0.21.4-beta, =0.72.0,...

@abp/aspnetcore.mvc.ui.theme.basic (>=0.2.1, <=9.1.3), @abp/aspnetcore.mvc.ui.theme.leptonxlite (>=1.0.0-beta.3, <=4.1.3) +425 more potentially affected by unknown CVE via toastr (>=2.0.4, <=2.1.4)

toastr NPM version =2.0.4, =0.2.1, =1.0.0-beta.3, =0.2.3, =4.4.0-rc.1, =0.3.0, =1.1.0, =1.1.0, =1.1.0, =1.0.1-alpha.0, =1.0.9, =0.5.0, =0.0.1, =1.0.0, =1.0.6 - @bycore/aspnetcore.mvc.ui.theme.basic 3.0.5-beta - @bycore/aspnetcore.mvc.ui.theme.shared 3.0.5-beta and more Source cves: unknown CVE...