Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

CVE-2026-46421

## Impact On April 29, 2026, compromised versions of `@cap-js/sqlite@2.2.2`, `@cap-js/postgres@2.2.2`, and `@cap-js/db-

历史摘要 · 未重新核验 · GitHub Advisory

Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

CVE-2026-46412

## Summary Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 m

历史摘要 · 未重新核验 · GitHub Advisory

Broken dropper in @mistralai/mistralai, @mistralai/mistralai-azure, @mistralai/mistralai-gcp

Mistral npm `@mistralai/mistralai`, `@mistralai/mistralai-azure`, `@mistralai/mistralai-gcp` were compromised by a suppl

历史摘要 · 未重新核验 · GitHub Advisory

Malicious dropper in mistralai 2.4.6 PyPI package

The `mistralai` PyPI package version `2.4.6` contains a malicious dropper that executes on import on Linux. No `v2.4.6`

历史摘要 · 未重新核验 · GitHub Advisory

A supply chain attack compromised the official installation packages of DAEMON Tools Lite ...

CVE-2026-8398

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421

历史摘要 · 未重新核验 · GitHub Advisory

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate web...

CVE-2026-8398

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421

历史摘要 · 未重新核验 · NVD

PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting...

CVE-2026-44484

PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introdu

历史摘要 · 未重新核验 · NVD

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were published to the npm registry. The publishes were authenticat...

CVE-2026-45321

On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 @tanstack/* packages were publ

历史摘要 · 未重新核验 · NVD

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

CVE-2026-45321

## Summary On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84 malicious versions across 42 `@tanstack/*` pack

历史摘要 · 未重新核验 · GitHub Advisory

Compromised version of intercom-client published to npm

### Impact On April 30, 2026, version 7.0.4 of intercom-client was published to npm using credentials obtained from a c

历史摘要 · 未重新核验 · GitHub Advisory

Compromised tag of intercom-php published via GitHub

### Impact On April 30, 2026, a malicious commit was pushed to the intercom/intercom-php repository and tagged as versi

历史摘要 · 未重新核验 · GitHub Advisory

Compromise of PyTorch Lightning PyPi Package Versions

CVE-2026-44484

# Security Advisory: Compromise of PyTorch Lightning PyPI Package Versions **Published:** 2026-04-30 **Last Updated:*

历史摘要 · 未重新核验 · GitHub Advisory

`mysten-metrics` was removed from crates.io for malicious code

`mysten-metrics` included a build script that attempted to exfiltrate data from the build machine. The malicious crate

历史摘要 · 未重新核验 · GitHub Advisory

`sui-execution-cut` was removed from crates.io for malicious code

`sui-execution-cut` included a build script that attempted to exfiltrate data from the build machine. The malicious cra

历史摘要 · 未重新核验 · GitHub Advisory