0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
akrai-report-new
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting akrai-report-new, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-10956 | Unknown | Malicious code in akrai-report-new (npm)The akrai-report-new package was published to the npm registry by user 'jonothhu' (maintainer email bruemleveroger@gmail.com) as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped (@scope/name) forms so that a misconfigured resolver installs the public lookalike instead of an intended private/internal dependency. Each package self-describes as an 'AUTHORIZED SECURITY RESEARCH CANARY' (static token PATHC-CANARY-2026, contact farouqsa@proton.me), but ships an unconsented install-time beacon and |
| OSV (opens in a new tab) |
The akrai-report-new package was published to the npm registry by user 'jonothhu' (maintainer email bruemleveroger@gmail.com) as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped (@scope/name) forms so that a misconfigured resolver installs the public lookalike instead of an intended private/internal dependency. Each package self-describes as an 'AUTHORIZED SECURITY RESEARCH CANARY' (static token PATHC-CANARY-2026, contact farouqsa@proton.me), but ships an unconsented install-time beacon and