This report summarizes 14 supply-chain security threats detected across npm, PyPI, and AI ecosystems. Critical threats include credential harvesting malware in u/cap-js packages (CVE-2026-46421), a worm payload in u/beproduct/nestjs-auth (CVE-2026-46412), and a supply chain compromise in guardrails-ai (CVE-2026-45758). High-severity issues include denial-of-service vulnerabilities in Parse Server (CVE-2026-47138) and qs (CVE-2026-8723), memory and disk exhaustion in libp2p packages, remote code execution vulnerabilities in Diffusers (CVE-2026-45804) and lmdeploy (CVE-2026-46517), SSRF vulnerabilities in Crawlee and SillyTavern, and injection or prototype hijacking attacks in samlify and js-cookie. The critical u/cap-js packages require immediate upgrade to patched versions. The guardrails-ai malicious version has been quarantined. The report is based on a Reddit cybersecurity daily digest linking to external sources.

The critical vulnerabilities enable credential harvesting and self-propagation malware, potentially compromising local credentials and spreading malicious code through npm packages. The worm payload in nestjs-auth can propagate within affected environments. The guardrails-ai compromise involves a malicious PyPI package version that has been quarantined. High-severity vulnerabilities can cause denial-of-service conditions, remote code execution, server-side request forgery (SSRF), privilege escalation, and prototype hijacking, impacting availability, confidentiality, and integrity of affected systems. Exploitation could disrupt services, allow unauthorized code execution, or escalate privileges. No known exploits in the wild are reported yet.

For critical threats, immediately upgrade u/cap-js packages to sqlite >= 2.4.0, postgres >= 2.3.0, and db-service >= 2.10.2. Remove and reinstall u/beproduct/nestjs-auth dependencies if installed between versions 0.1.2 and 0.1.19, and audit for compromise. Uninstall guardrails-ai version 0.10.1 and reinstall a known good version. For high-severity DoS and RCE vulnerabilities, apply vendor patches or updates as they become available. For SSRF and injection issues, update configurations and dependencies per vendor guidance. Since no vendor advisories or patch links are provided here, check official sources for current remediation status. Assume local credentials may be compromised if affected packages were installed. No vendor advisory content is included, so patch status beyond critical package upgrades is not confirmed.