OSV - Open Source Vulnerabilities

MAL-2026-6702

npm/vue-demi-fix

Malicious code in vue-demi-fix (npm)

30 Jun

No fix available

MAL-2026-5438

npm/corporate-front-vue

Malicious code in corporate-front-vue (npm)

09 Jun

No fix available

MAL-2026-5165

npm/@emcd-vue/loans

Malicious code in @emcd-vue/loans (npm)

01 Jun

No fix available

MAL-2026-5163

npm/@emcd-vue/auth

Malicious code in @emcd-vue/auth (npm)

01 Jun

No fix available

MAL-2026-5164

npm/@emcd-vue/b2b-pay-form

Malicious code in @emcd-vue/b2b-pay-form (npm)

01 Jun

No fix available

MAL-2026-4707

npm/vue-compiler-sfc-plugin

Malicious code in vue-compiler-sfc-plugin (npm)

25 May

No fix available

MAL-2026-3887

npm/@antv/f-vue

Malicious code in @antv/f-vue (npm)

19 May

No fix available

MAL-2026-3897

npm/@antv/f2-vue

Malicious code in @antv/f2-vue (npm)

19 May

No fix available

MAL-2026-4081

npm/@antv/s2-vue

Malicious code in @antv/s2-vue (npm)

19 May

No fix available

MAL-2026-4116

npm/@antv/x6-vue-shape

Malicious code in @antv/x6-vue-shape (npm)

19 May

No fix available

MAL-2026-3777

npm/vue-template-compiler-plugin

Malicious code in vue-template-compiler-plugin (npm)

13 May

No fix available

MAL-2026-3499

npm/@tanstack/vue-start-client

Malicious code in @tanstack/vue-start-client (npm)

12 May

No fix available

GHSA-g7cv-rxg3-hmpx

npm/@tanstack/arktype-adapter
npm/@tanstack/eslint-plugin-router
npm/@tanstack/eslint-plugin-start
npm/@tanstack/history
npm/@tanstack/nitro-v2-vite-plugin
... 37 more

Malware in @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

12 May

Fix available
Severity - 9.6 (Critical)

MAL-2026-3496

npm/@tanstack/vue-router-devtools

Malicious code in @tanstack/vue-router-devtools (npm)

12 May

No fix available

MAL-2026-3497

npm/@tanstack/vue-router-ssr-query

Malicious code in @tanstack/vue-router-ssr-query (npm)

11 May

No fix available

MAL-2026-3495

npm/@tanstack/vue-router

Malicious code in @tanstack/vue-router (npm)

11 May

No fix available