0vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate0 (0.0%)
- Low0 (0.0%)
new-helper
Ecosystem: npm
Downloads:
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 0ModerateAffects 0 versions
- 0LowAffects 0 versions
Monthly breakdown
- 0 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 0
- Low: 0
Vulnerabilities (1)
Known vulnerabilities affecting new-helper, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| MAL-2026-6284 | Unknown | Malicious code in new-helper (npm)--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (47f6e9bcab53d95265012a31a4dcfc1485ed6db858e788e68ac2ac1ebc33fc34) index.js imports child_process and contains execSync calls invoking bash and zsh (around lines 301 and 317). Without traced execution context, it is not possible to determine whether these calls are reachable at install/import time, whether they execute attacker-controlled content, or whether they are gated behind explicit user CLI invocation. No hardcoded attacker C2, credential-path reads, or known-bad-infrastructure fingerprints are pres |
| OSV (opens in a new tab) |
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (47f6e9bcab53d95265012a31a4dcfc1485ed6db858e788e68ac2ac1ebc33fc34) index.js imports child_process and contains execSync calls invoking bash and zsh (around lines 301 and 317). Without traced execution context, it is not possible to determine whether these calls are reachable at install/import time, whether they execute attacker-controlled content, or whether they are gated behind explicit user CLI invocation. No hardcoded attacker C2, credential-path reads, or known-bad-infrastructure fingerprints are pres