ROOT-APP-NPM-CVE-2026-42035 CVE-2026-42035 in axios - Patched by Root

Root has patched CVE-2026-42035 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-42033 CVE-2026-42033 in axios - Patched by Root

Root has patched CVE-2026-42033 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-25639 CVE-2026-25639 in axios - Patched by Root

Root has patched CVE-2026-25639 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2025-58754 CVE-2025-58754 in axios - Patched by Root

Root has patched CVE-2025-58754 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44496 CVE-2026-44496 in axios - Patched by Root

Root has patched CVE-2026-44496 in the axios package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44487 CVE-2026-44487 in axios - Patched by Root

Root has patched CVE-2026-44487 in the axios package for Root:npm. Multiple fixed versions available...

MAL-2026-14239 Malicious code in gaarf-node-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an...

MAL-2026-14238 Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

MAL-2026-14237 Malicious code in gaarf-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 841d3bc6f2f6b55bfe6c3d3ffd5daf2eb586507bbe35ff5ab8e706db076357d0 On npm install, the package's postinstall lifecycle script collects installer host identifiers os.hostname, process.platform, process.arch, Node...

MAL-2026-14236 Malicious code in gaarf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3312540cdedc807029a549ffd3b49b917704323a3b664c6d71ae6849c192b9 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers os.hostname, platform, arch, Nod...

MAL-2026-14235 Malicious code in config-helper-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...

MAL-2026-14234 Malicious code in commandor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d The package's scripts/postinstall.js runs automatically on npm install and imports childprocess alongside http.request with multiple POST call sites...

MAL-2026-14233 Malicious code in code-assist-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 093f28fd5542ee841027c5b3dc6917a42ac13dd3e0e1d3bf334e87b823886d3c [email protected] runs a postinstall lifecycle script that collects host identifiers hostname, platform, arch, Node version, package name and POS...

MAL-2026-14232 Malicious code in chromeos-webdriver-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bbf3413f6465a1f8bb628dcdb79f59ac7c197bbfba2024202c9915f95ad8161 The package's postinstall script runs on npm install and issues an HTTPS POST to https://kvpq6u62.instances.poc.jchunt.top/chromeos-webdriver-cli...

MAL-2026-14231 Malicious code in chromecast-webdriver-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c858cd5357d77c39366f7bd1cc1985a5d7012d33da45d6dc9667544b54198d6 [email protected] runs a postinstall lifecycle script that collects host metadata os.hostname, platform, arch, node version, package nam...

MAL-2026-14230 Malicious code in chrome-enterprise-premium-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850bd071a15b1c20097032c5861cdfdeb970d05b4e28f65d5bcdb411fba5d10d chrome-enterprise-premium-mcp ships a postinstall lifecycle script that fires automatically on npm install and POSTs installer host metadata...

MAL-2026-14229 Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

MAL-2026-14228 Malicious code in broadcast-graphics-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48987a1a0ccff7dce1134e1a98122cd902961ac34ba623ae0e2fef62f75fe213 The package's postinstall script runs automatically on npm install and collects host identifiers from the installer machine os.hostname, platform,...

MAL-2026-14227 Malicious code in bazelisk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4bcbd35130e716d1a2940c91b6691d41b9655fdc8587404af37bc6e5a7f1370 This npm package uses the name bazelisk, colliding with Google's bazelbuild/bazelisk project referenced in the tarball's source.txt, and self-labels ...

MINI-H4M4-7JW8-95C9

Bulletin has no description...

MINI-R5MR-8XVV-8F7W

Bulletin has no description...

MINI-GVFQ-RPMR-M6FH

Bulletin has no description...

MINI-V9G9-9QFQ-X5CP

Bulletin has no description...

MINI-WGF6-8GJ4-JF5H

Bulletin has no description...

MAL-2026-14226 Malicious code in animate-css-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d6c86a03c6106e799d0817676fcc92f022b64790aab209aa9fe663c085c4e6 plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a consumer's build instantiate...

MINI-R864-HHFV-HH5X

Bulletin has no description...

MINI-79VG-FVWM-84WW

Bulletin has no description...

MAL-2026-14225 Malicious code in ambera (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625 The package presents itself as a zero-dependency SVG helper, but its exported getPlugin function performs an HTTPS GET to the hardcoded host...

MAL-2026-14217 Malicious code in ai-texts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f70364834c6aa09fed4520d6144867e921c75f416d315addf2ec3b28a92d2e4 The package advertises itself as text helpers for AI pipelines toText/normalizeText but src/index.js unconditionally invokes a dropper at module top...

MAL-2026-14218 Malicious code in mapkit-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2d3c3e234b52b2bbffe7b197f9ec483b2b574667543338b975c99831633c86 Unscoped npm package 'mapkit-loader' impersonates the scoped '@apple/mapkit-loader' to intercept mistyped npx mapkit-loader invocations. The...

MINI-7WX9-58H8-Q5F7

Bulletin has no description...

MINI-JX36-972P-W939

Bulletin has no description...

MINI-4P7V-2W4G-F5CR

Bulletin has no description...

MINI-X9Q2-XJC8-3592

Bulletin has no description...

MAL-2026-14219 Malicious code in setup-codex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957e8b8d535ccc5e5d7e84e99a51695f7a50a4417bfca5f3582ae2817ca75846 The package's lib/report.js requires childprocess, fs, https, and os at the top of the module and constructs an HTTPS POST to a hardcoded destination...

MAL-2026-14220 Malicious code in solidity-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39144e822a0964821b92859c04cbe7311ac13a889c585465ac0533c831f1904f The npm package [email protected] impersonates the popular pino logger: the README badges and lib/ source tree are copied from pino pinojs/pino, bu...

MAL-2026-14221 Malicious code in ssb-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 086e13ef78d9987210a95cc9e70359d982cd9dbffa59d674d6f5ed3cb8f8a725 [email protected] is a dependency-confusion proof-of-concept. package.json declares preinstall: node poc.js, and poc.js runs unconditionally on...

MAL-2026-14222 Malicious code in streak-cal-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4e42ea741c3a61878fa72cd8b7ab4547c52f14b69f429129c46edba70771287 index.mjs the package's main entry contains a 500 KB base64-encoded x86-64 ELF payload stored in a store array disguised with a // --- Calibration Da...

MAL-2026-14223 Malicious code in streak-key-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c569633a277a8a3374b8ca058ec451a726d110cca3599f429bfe72d6d2b7a7b6 index.mjs advertises itself as a dependency-free, browser-safe day-math helper that 'touches no network and no filesystem,' but the file body contain...

MAL-2026-14224 Malicious code in streak-metric-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06a07dcfac11a25f5e9074d867bee34fa01ba0926b30cb4c21f75a2787bdac77 [email protected] ships a fully wired dropper that fires on import/require of the package root. The top-level async IIFE in dist/index.mjs...

MAL-2026-14209 Malicious code in sui-gql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12074ac469d8426297f5f8bb3dd28fd48424a71348b2c16590fd4b41e4e6ad33 On require, lib/telemetry.js runs a top-level IIFE that reads the installer's /.gitconfig, extracts the configured email addresses and user name,...

MAL-2026-14210 Malicious code in sui-graphql-rpc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba4994f544d3df11fa82980f25dc29e379f25a3e03fdbf9a448e995a75ac76a7 On require'sui-graphql-rpc', index.js loads lib/telemetry.js which reads /.gitconfig from the installer's home directory, extracts the developer's...

MAL-2026-14216 Malicious code in timed-assess (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d39931b57405563b5114ee92146f85eeeddbeb0e235dae9f483c2b30764f47e package.json declares postinstall: node apps, which loads apps/index.js. The script reads a bundled file, decrypts it with hardcoded DES key...

MAL-2026-14214 Malicious code in sysc1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json main is index.js which invoke...

MAL-2026-14215 Malicious code in sysdo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb784f77e0ba034d13e3ca39aa5f3f401ab659deaafbb0b28d880c21293bde33 The package is published as a 'System binary configuration tool' but its actual payload is a Windows surveillance harness. pointer.py registers globa...

MAL-2026-14213 Malicious code in syjoy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d09a5d503a9a198f34720bcec601970125f514b666820b7a3b814e5d21bf1529 The npm package syjoy advertises itself as a 'System binary configuration tool' but ships a Python payload pointer.py that harvests user data across...

MAL-2026-14212 Malicious code in syboy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f53c03163c0e0b47e20d28751745a66ecd1c9aadda7e96d648e8390ba49506f7 On invocation, index.js spawns starttool.vbs via wscript.exe with detached/windowsHide flags; the VBS calls ShellExecute cmd.exe with the 'runas' ver...

MAL-2026-14211 Malicious code in sw-pluginer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38427a19b5e267273200d4dc05d0b9a60f0a38bfe7916adaaeb90338af5f1b06 sw-pluginer presents itself as a Tailwind plugin for service worker registration, but its main export — invoked when Tailwind processes its config vi...

MAL-2026-14208 Malicious code in eth-batcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a725b819260b649f04c27142a0c6e5d219304f6ab038f8717533c2b3416599 index.js is a verbatim copy of an unrelated Mongoose LeanHooks Plugin with a 149 KB obfuscated Function... payload concatenated onto the module.expor...

MAL-2026-14203 Malicious code in @lilsccott6x9/devpipe-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8615ec2381e2fc36518a5f991f1a132ffe8c86fc458a7072585bb950644eb1f The package's postinstall lifecycle hook package.json declares postinstall=node scripts/setup.js decodes base64-encoded shell command strings and...