The npm package @beloved-lenora/opencode-shared-rpc contains malicious code that fully compromises any computer on which it is installed or running. Immediate removal of the package is advised, but full remediation requires rotating all secrets and keys from a different, uncompromised machine due to potential persistent control by an attacker.
The npm package @beloved-lenora/opencode-shell-guard contains malicious code that fully compromises any computer on which it is installed or running. Immediate rotation of all secrets and keys stored on the affected computer is required, and the package should be removed. However, removal does not guarantee elimination of all malicious software, as the attacker may have gained full control of the system.
The npm package @xatancchii/natabaileys contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The npm package 'parxleys' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the system. Immediate removal of the package is recommended, but due to the potential extent of the compromise, removing the package alone may not eliminate all malicious software. All secrets and keys stored on the affected computer should be rotated from a separate, secure machine.
The @flexmr/survey-conversation npm package contains malicious code due to its sole dependency being declared as a bare HTTPS URL, allowing arbitrary code execution from an external source. This design enables whoever controls the external host to execute any code on the installer's machine. The package is associated with a dependency-confusion attack and should be considered fully compromising any system where it is installed.
The npm package @flexmr/survey-client version 10.0.12 and several other versions declare a dependency as a bare HTTPS URL pointing to an external host unrelated to the official npm registry. This external host controls the code executed during installation, allowing arbitrary code execution on the installer's machine. The package exhibits dependency confusion markers and placeholder metadata inconsistent with a legitimate package, indicating malicious intent. Any system with this package installed should be considered fully compromised.
The npm package 'asistenyorstore' version 8.0.14 contains malicious code that uses an authenticated WhatsApp session to auto-follow newsletters controlled by the package author. The package fetches remote JSON lists from mutable URLs and issues follow requests on behalf of the installer's account without exfiltrating credentials or executing remote code. Despite no direct data theft, any system with this package installed should be considered fully compromised due to potential unauthorized control. Immediate removal and secret/key rotation are advised.
An authenticated user in @backstage/backend-defaults versions prior to 0.17.8 could invoke backend actions that were intended to be excluded by an operator's action configuration. Although existing action permissions and downstream authorization checks remain in place, this improper access control could lead to unauthorized action invocation. The issue is patched in version 0.17.8. Until upgrading, it is recommended to restrict access to action invocation endpoints to trusted service callers.
A Zip Slip vulnerability (CVE-2026-103975) exists in the @appium/support package's ZIP extraction functionality. This issue allows an attacker to escape the intended extraction directory by using symbolic links inside the archive. Unlike a previous path traversal vulnerability fixed in version 7.0.6, this flaw involves legitimate entry names with no '..' components, where a symlink points outside the extraction root and subsequent files follow that symlink to write outside the target directory. This vulnerability affects versions prior to 7.2.6 and has a medium severity rating.
## Summary
When cache interception is enabled, `@opennextjs/cloudflare` can interpret percent-encoded paths differently during middleware matching and cache lookup.
An encoded request may fail to match authorization middleware, then be decoded into the cache key of a protected route. The cached response may consequently be returned without invoking the middleware.
`enableCacheInterception` is disabled by default.
## Impact
A remote unauthenticated attacker may retrieve cached content from routes intended to be protected by middleware.
An application is affected when it:
- explicitly enables `enableCacheInterception`;
- relies on middleware for access control; and
- has a matching cached route.
## Details
Middleware matching previously used the encoded request pathname, while cache interception decoded the pathname before selecting a cache entry.
For example, consider an application with:
- middleware matcher `/admin/:path*`;
- middleware returning `401 Authentication required` for `/admin`;
- a statically generated, cached `/admin` route; and
- cache interception enabled:
```ts
export default defineCloudflareConfig({
incrementalCache: staticAssetsIncrementalCache,
enableCacheInterception: true,
});
```
An attacker can request:
```http
GET /%61dmin
```
The encoded pathname does not match `/admin/:path*`, so the authorization middleware is not invoked. Cache interception then decodes `%61dmin` to `admin` and may return the cached `/admin` response:
```http
HTTP/1.1 200 OK
x-opennext-cache: HIT
Protected content
```
Malformed paths exposed an additional inconsistency. For example:
```http
GET /%61dmin/%ZZ
```
The previous implementation decoded each segment independently. It decoded `%61dmin` to `admin` but retained the malformed `%ZZ` segment, allowing cache lookup to continue using a partially decoded pathname.
## Patches
The fix aligns encoded-path handling across middleware matching and cache lookup, and rejects malformed paths instead of partially decoding them. See the upstream fixes in [opennextjs-aws#1199](https://github.com/opennextjs/opennextjs-aws/pull/1199) and [opennextjs-aws#1200](https://github.com/opennextjs/opennextjs-aws/pull/1200).
Users should upgrade to `@opennextjs/cloudflare@1.20.2` or later.
## Workarounds
If upgrading is not immediately possible for an application:
1. Disable cache interception by removing `enableCacheInterception: true`.
2. Enforce authorization inside protected route handlers rather than relying exclusively on middleware.
3. Reject encoded paths for protected routes at a trusted proxy before they reach the Worker.
Adding individual encoded matcher variants is not a complete workaround because pathnames can have multiple equivalent encodings.
A vulnerability in nuxt-modules og-image versions 6.2.5 through 6.6.x allows unauthenticated attackers to inject attacker-controlled image data into the Open Graph image cache by exploiting the dynamic /_og/d/*.png route. This can cause spoofed Open Graph images to be served to users. The issue is fixed in version 6.7.0.
The npm package buyerdashboard@45.3.4 contains malicious code that executes during installation. Its preinstall script runs a Node.js script that sends a request to an external domain with a hardcoded authorization token, disclosing the installing host's public IP and metadata without user consent. The package also depends on a suspicious similarly named package that shadows a core Node module, indicating potential dependency confusion. The package's metadata and versioning suggest it is designed to evade detection and perform unauthorized data exfiltration.
The npm package xapi-lib versions 88.2.3, 88.2.5, 90.2.1, and 90.3.1 contains malicious code that executes a preinstall script during npm install. This script sends an HTTP request with a hardcoded authorization header to an external domain unrelated to the package's stated functionality, potentially exposing the installer's IP and environment. The package itself provides no legitimate library functionality and is considered fully malicious.
The npm package web-pixels-manager@76.2.4 is a typosquatted malicious package impersonating Shopify's @shopify/web-pixels-manager. It executes a preinstall script that makes an outbound HTTPS request to a non-affiliated domain realwbx.com with a hardcoded authorization token. This behavior enables the operator of realwbx.com to track installations of the package, effectively creating a victim check-in channel.
The npm package idlive-face-capture-web-development@78.8.1 contains malicious code that executes a preinstall script making an unauthorized HTTPS request to a third-party server with a hardcoded authorization token. This behavior leaks the installer's IP address, User-Agent, and install timing, confirming successful execution to an attacker-controlled server. The package identity is inconsistent and indicative of a dependency confusion or typosquatting attempt. Installation of this package may lead to full compromise of the host system.
nodejs-whisper versions prior to 0.4.0 contain a critical OS command injection vulnerability in the convertToWavType() function. This flaw allows attackers to execute arbitrary OS commands by supplying specially crafted audio file paths that include command substitution or quote characters. The vulnerability arises because these inputs are interpolated unsafely into an ffmpeg command executed via shelljs exec(), running with Node.js process privileges. A fix is available in version 0.4.0.
git-diff versions prior to 2.0.7 contain a critical OS command injection vulnerability. This flaw allows attackers to execute arbitrary shell commands by supplying specially crafted strings to the gitDiff API. The vulnerability arises because the API evaluates these strings using shelljs.exec with Node.js process privileges. A fix is available in version 2.0.7.
The npm package '@flexmr/utils' versions 1.0.0 and 3.0.12 have been identified as malicious. The package executes commands associated with malicious behavior, posing a security risk to users who install or use these versions.
The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using `git checkout` without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash. Exploitation required a user to install a malicious plugin, pin to a safe hash, and for the plugin source to be hosted on a git host that permitted SHA-shaped branch names.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version.
Thank you to Or Nevo Michrowski of Air Security for reporting this issue.
CVE-2026-84994 is a high-severity vulnerability in the Qwik JavaScript framework prior to versions 1.20.0 and 2.0.0-beta.37. It involves uncaught exceptions caused by improper handling of thenables during server-side JSON deserialization. An unauthenticated attacker can send specially crafted requests that cause the Node.js server to terminate due to unhandled promise rejections, resulting in denial of service. This can crash a single server or keep multiple replicas unavailable. The issue is fixed in the specified versions.