The npm package 'dowload_ebok_a_yorkshire_tragedy_by_anthony_clavane_wkvgf' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but full remediation may require rotating all secrets from a separate, uncompromised device due to potential persistent malicious presence.
The npm package 'dowload_ebok_un_mal_principio_una_serie_de_catastroficas_desdi_by_lemony_snicket_1e5wl' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package 'dowload_ebok_severe_weather_flying_by_dennis_newton_3gac2' is identified as malicious software. Any system with this package installed or running is considered fully compromised, with potential unauthorized control by an external entity. Immediate rotation of all secrets and keys stored on the affected system is advised, and the package should be removed. However, removal may not guarantee elimination of all malicious components due to possible persistent control.
The npm package 'dowload_ebok_de_gouden_eeuw_van_rome_by_anton_van_hooff_q5ldi' contains malicious code that can fully compromise any computer on which it is installed or run. This compromise may lead to unauthorized access and control by an outside entity. Immediate removal of the package is advised, but due to potential persistent compromise, all secrets and keys on the affected system should be rotated from a separate, trusted machine.
The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cause downstream applications to make authorization decisions using claim values different from those validated. Exploitation requires attacker-controlled claims in a JWT signed by a key trusted by the application. This vulnerability (CVE-2026-19194) is fixed in cap 0.14.0.
CVE-2026-102632 is an incorrect privilege assignment vulnerability in Devolutions PowerShell Universal versions 2026.3.4 and earlier. It allows an authenticated user with token creation or update permissions to escalate privileges to administrator. Additionally, in multi-node deployments, a revoked app token can be reinstated via crafted requests that manipulate role or revocation state. This issue is fixed in version 2026.3.5.
The npm package 'dowload_ebok_toyota_kata_by_mike_rother_x5civ' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone may not eliminate all malicious software introduced by its installation.
The npm package 'dowload_ebok_my_life_on_the_road_by_gloria_steinem_ntmg8' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'dowload_ebok_il_domatore_di_leoni_by_camilla_lackberg_ta2zx' contains malicious code that fully compromises any computer on which it is installed or executed. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Simply removing the package does not guarantee removal of all malicious components, as the attacker may have established persistent control.
The npm package 'dowload_ebok_retron_by_raul_gay_navarro_1734c' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but complete remediation may require rotating all secrets and keys from a separate, uncompromised system due to potential persistent malicious control.
The npm package 'dowload_ebok_la_santa_misa_y_el_divino_protocolo_by_jose_fernando_rey_ballesteros_2gw03' contains malicious code that can fully compromise any computer on which it is installed or run. Installation of this package may result in an attacker gaining full control over the affected system. Immediate removal of the package is advised, and all secrets and keys stored on the compromised machine should be rotated from a separate, secure device. However, removal of the package does not guarantee complete eradication of all malicious software introduced by it.
The npm package 'dowload_ebok_ernie_pyle_in_england_by_ernie_pyle_w39s5' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to all secrets and keys stored on the affected machine. Immediate removal of the package is advised, but due to potential persistent control by attackers, complete remediation may require additional measures such as rotating all credentials from a secure device.
The NLTK package's LegalitySyllableTokenizer.tokenize method contains an unguarded quadratic CPU complexity loop when processing tokens composed entirely of vowels. This allows an attacker controlling the token input to cause CPU exhaustion by supplying a long vowel-only token, leading to denial of service or latency degradation. The vulnerability affects versions from 3.6 up to but not including 3.10.4 and has been fixed in version 3.10.4. There is no confidentiality or integrity impact, only availability degradation.
The npm package 'dowload_ebok_the_agent_runner_by_simon_conway_70ch1' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee full remediation due to potential persistent malicious software.
The npm package 'dowload_ebok_gut_essen_bei_erhohtem_cholesterin_by_dagmar_von_cramm_vera_herbst_ss4nt' is identified as malicious software. Installation or execution of this package results in full compromise of the affected computer. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised machine. However, removal of the package alone may not eliminate all malicious components due to potential full system control by attackers.
The npm package 'dowload_ebok_de_buena_familia_by_cynthia_d_aprix_sweeney_kwzs7' contains malicious code that compromises any computer on which it is installed or run. Installation of this package results in full system compromise, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but full remediation may require rotating all secrets from a separate, uncompromised machine due to possible persistent malicious presence.
The npm package 'dowload_ebok_a_oracao_na_ponta_dos_dedos_by_papa_francisco_wncf1' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may lead to full system compromise, including unauthorized access to stored secrets and keys. Immediate removal of the package is advised, but complete remediation may require rotating all secrets and keys from a separate, uncompromised device due to potential persistent control by attackers.
The npm package 'dowload_ebok_the_radium_girls_by_kate_moore_jzc94' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_sydney_noir_by_michael_duffy_nick_hordern_4y353' is identified as malicious software. Any system with this package installed or running is considered fully compromised, potentially allowing an attacker full control. Immediate rotation of all secrets and keys stored on the affected system from a separate, secure machine is strongly advised. Removal of the package is recommended, but it may not fully eliminate the malicious presence due to possible persistent control established by the attacker.
The npm package 'dowload_ebok_moon_knight_2016_t01_by_jeff_lemire_greg_smallwood_zl1xj' contains malicious code that compromises any computer on which it is installed or executed. Installation of this package may result in full system compromise, allowing an attacker to gain control over the affected machine. Immediate removal of the package and rotation of all secrets and keys from a separate, secure device is strongly advised.