Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview @jagreehal/workflow is a Typed async workflows with automatic error inference. Build type-safe workflows with Result types, step caching, resume state, and human-in-the-loop support. Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious...

cellist (>=1.0.0, <=1.1.1), feast-py (>=0.1.7, <=1.0.1) +1 more potentially affected by unknown CVE via spateo-release (>=1.0.2, <=1.1.1)

spateo-release PYPI version =1.0.2, =1.0.0, =0.1.7, =1.0.1 - feast-sim 0.1.7 Source cves: unknown CVE Source advisory: SNYK:PYTHON-SPATEORELEASE-17220148...

bioimageio-engine (>=0.1.0, <=0.1.3), executor-engine (>=0.0.1, <=0.3.3) +9 more potentially affected by unknown CVE via cmd2func (0.2.1)

cmd2func PYPI version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on cmd2func and may be impacted: - bioimageio-engine =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.1, =0.3.0, =0.1.1, =0.5.0, =0.5.4 Source cves: unknown CVE Source advisor...

17fe-ui23 (>=0.0.0, <=0.0.24), @2kog/pkg-editor (>=0.0.1, <=0.1.3) +747 more potentially affected by CVE-2026-47761 via tinymce (>=6.0.0, <=7.5.1)

tinymce NPM version =6.0.0, =0.0.0, =0.0.1, =12.1.0, =4.1.0, =1.0.0-beta.1, =4.1.2-rc, =1.0.0, =0.1.0, =0.1.23 and more Source cves: CVE-2026-47761 Source advisory: OSV:GHSA-VG35-5WQ7-3X7W...

17fe-ui23 (>=0.0.0, <=0.0.24), @2kog/pkg-editor (>=0.0.1, <=0.1.3) +717 more potentially affected by CVE-2026-47760 via tinymce (>=6.8.1, <=7.0.1)

tinymce NPM version =6.8.1, =0.0.0, =0.0.1, =12.1.0, =4.1.0, =1.0.0-beta.1, =4.1.2-rc, =1.0.0, =1.1.1 - @amis-adapter/amis-editor-react 0.0.1 - @amis-adapter/vue-amis-editor-webpack 0.1.0 - @amis-adapter/vue-editor2.7 0.0.0 - @amis-adapter/vue2.7 0.0.0 - @anhoang/tinymce-vue 5.1.2-rc -...

aibrix-kvcache (>=0.1.0, <=0.1.0.post2), lmcache (>=0.3.0, <=0.3.5) +1 more potentially affected by CVE-2026-11312 via infinistore (0.2.35)

infinistore PYPI version 0.2.35 is affected by a known vulnerability. The following packages have a transitive dependency on infinistore and may be impacted: - aibrix-kvcache =0.1.0, =0.3.0, =0.3.5 - lmcache-test-test 1.0.5 Source cves: CVE-2026-11312 Source advisory:...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @a0dotrun/expose (>=0.0.2, <=0.0.4) +621 more potentially affected by CVE-2026-47673 via hono (>=4.0.0, <=4.12.19)

hono NPM version =4.0.0, =0.1.8-fix.3, =0.0.2, =0.3.1, =0.9.0, =0.1.0, =0.1.9, =0.2.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.16 and more Source cves: CVE-2026-47673 Source advisory: OSV:GHSA-F577-QRJJ-4474...

a2 (>=0.4.9, <=0.8.3), abadpour (>=6.13.1, <=7.24.1) +940 more potentially affected by CVE-2026-10803 via mlflow-skinny (>=1.19.0, <=3.15.1)

mlflow-skinny PYPI version =1.19.0, =0.4.9, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.1.0, =1.0.0, =0.1.0, =1.1.1 - ai-helpers-pytorch-utils 0.1.0a1 and more Source cves: CVE-2026-10803 Source advisory: SNYK:PYTHON-MLFLOWSKINNY-17173042...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +16283 more potentially affected by CVE-2026-44496 via axios (>=1.0.0, <=1.15.2)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-44496 Source advisory: SNYK:JS-AXIOS-17172532...

20231122-npm (1.0.0), 2d-json-schema-editor-visual (>=1.0.2, <=1.0.7) +6010 more potentially affected by CVE-2026-5078 via morgan (>=1.2.0, <=1.10.1)

morgan NPM version =1.2.0, =1.0.2, =1.0.0, =0.0.1, =1.0.0, =0.2.0, =0.0.1, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =1.15.2 and more Source cves: CVE-2026-5078 Source advisory: SNYK:JS-MORGAN-17135841...

deebo-prototype (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-10691 via @wonderwhy-er/desktop-commander (0.1.39)

@wonderwhy-er/desktop-commander NPM version 0.1.39 is affected by a known vulnerability. The following packages have a transitive dependency on @wonderwhy-er/desktop-commander and may be impacted: - deebo-prototype =1.0.0, =1.0.1 Source cves: CVE-2026-10691 Source advisory:...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Cross-site Scripting (XSS)

Overview vitest is a Next generation testing framework powered by Vite Affected versions of this package are vulnerable to Cross-site Scripting XSS via the otelCarrier query parameter being directly inserted into an inline script without sanitization. An attacker can execute arbitrary JavaScript ...

@etherna/sdk-js (>=2.0.1, <=2.0.3), @eui/deps-base (>=21.0.0-alpha.33, <=23.0.0-alpha.1) +14 more potentially affected by CVE-2026-47429 via @vitest/ui (>=4.0.3, <=4.0.18)

@vitest/ui NPM version =4.0.3, =2.0.1, =21.0.0-alpha.33, =1.3.0, =0.3.5, =0.3.0, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.4.2 and more Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTUI-17120328...

com.browseengine.bobo:bobo-solr (>=3.0.0, <=3.2.0), com.browseengine.bobo:cardemo (>=3.0.0, <=3.2.0) +348 more potentially affected by CVE-2026-44825 via org.apache.solr:solr-core (>=1.3.0, <=10.0.0)

org.apache.solr:solr-core MAVEN version =1.3.0, =3.0.0, =3.0.0, =1.8.6, =0.40, =0.40, =0.3.1, =0.3.4, =0.3.4, =1.0.3, =1.0.3, =1.0.3, =1.0.5 and more Source cves: CVE-2026-44825 Source advisory: SNYK:JAVA-ORGAPACHESOLR-17139337...

agent-vm-hermes-adapter (>=0.0.116, <=0.0.132), apify-hermes-agent-plugin (>=0.1.0, <=0.1.1) +15 more potentially affected by CVE-2026-10221 via hermes-agent (>=0.13.0, <=0.19.0)

hermes-agent PYPI version =0.13.0, =0.0.116, =0.1.0, =0.1.3, =0.1.0, =3.0.0, =0.1.2, =2.5.17, =0.3.0, =0.1.0a16, =1.0.1, =1.0.0, =1.0.2, =0.1.0a0, =0.10.0, =0.10.7 and more Source cves: CVE-2026-10221 Source advisory: SNYK:PYTHON-HERMESAGENT-18507994...