Proto

Prototype Pollution in Proto

Prototype Pollution in chartkick

linux-cmdline is vulnerable to Prototype Pollution via the constructor

flatnest Prototype Pollution vulnerability

expr-eval vulnerable to Prototype Pollution

Prototype Pollution in dset

Prototype Pollution in iniparserjs

counterpart vulnerable to prototype pollution

Prototype Pollution in set-value

Prototype Pollution in bmoor

fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host from Untrusted Connections

Remote code execution via MongoDB BSON parser through prototype pollution

sequelize-typescript Prototype Pollution vulnerability

Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers

Prototype Pollution in merge-deep

Prototype Pollution in node.extend

web3-utils Prototype Pollution vulnerability

thlorenz browserify-shim vulnerable to prototype pollution

web3-core-method is vulnerable to prototype pollution

Malicious code in @protos-team/frontend-server (npm)

Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS)

Prototype Pollution in ini-parser

Prototype Pollution in set-or-get

plotly.js prototype pollution vulnerability

Resources Downloaded over Insecure Protocol in igniteui

eivindfjeldstad-dot contains prototype pollution vulnerability

Prototype pollution vulnerability in 'patchmerge'

radashi Allows Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Prototype Pollution in undefsafe

deepHas vulnerable to Prototype Pollution via constructor.prototype

Prototype Pollution in worksmith

Prototype pollution in nconf-toml

Prototype Pollution in lodash

Prototype pollution vulnerability in 'predefine'

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

Prototype Pollution in defaults-deep

Prototype Pollution in merge-options

Prototype Pollution in decal

Electron: HTTP Response Header Injection in custom protocol handlers and webRequest

json-schema-editor-visual vulnerable to prototype pollution

steal vulnerable to Prototype Pollution via requestedVersion variable

canvg Prototype Pollution vulnerability

Prototype Pollution in object-path

@ndhoule/defaults prototype pollution

Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows

Feather-Sequelize cleanQuery method vulnerable to Prototype Pollution

Prototype pollution in matrix-react-sdk

@aofl/cli-lib Prototype Pollution vulnerability

Prototype pollution in supermixer

ts-deepmerge before 2.0.2 vulnerable to Prototype Pollution

Prototype Pollution in deep.assign

Prototype pollution in multi-ini

Prototype Pollution in comb

Prototype Pollution in deep-get-set

Prototype Pollution in systeminformation

Prototype Pollution in express-fileupload

robinweser fast-loops vulnerable to prototype pollution

@stablelib/cbor: Prototype poisoning via `__proto__` map keys in CBOR decoding

Prototype pollution vulnerability in 'libnested'

Angular: SSRF via protocol-relative and backslash URLs in Angular Platform-Server

Locutus Prototype Pollution due to incomplete fix for CVE-2026-25521

Prototype Pollution in @strikeentco/set

Locutus has Prototype Pollution via __proto__ Key Injection in unserialize()

Prototype Pollution in handlebars

Incorrect protocol extraction via \r, \n and \t characters

Immutable is vulnerable to Prototype Pollution

Prototype Pollution in templ8

hoek subject to prototype pollution via the clone function.

Prototype pollution in ag-grid-community via the _.mergeDeep function

Svelte SSR attribute spreading includes inherited properties from prototype chain

Prototype Pollution

Prototype Pollution in json-ptr

Prototype Pollution in merge-change

Prototype Pollution in backbone-query-parameters

Prototype Pollution in merge

Prototype Pollution in open-graph

Prototype Pollution in set-value

SandboxJS Vulnerable to Prototype Pollution -> Sandbox Escape -> RCE

fast-xml-parser vulnerable to Prototype Pollution through tag or attribute name

MikroORM has Prototype Pollution in Utils.merge

dottie vulnerable to Prototype Pollution

Prototype Pollution in libnested

grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload

Prototype Pollution in litespeed.js and appwrite/server-ce

tarteaucitron.js allows prototype pollution via custom text injection

mockery is vulnerable to prototype pollution

Prototype pollution in set-object-value

jrburke requirejs vulnerable to prototype pollution

Prototype Pollution in multi-ini

dustjs-linkedin vulnerable to Prototype Pollution

Prototype Pollution in Node-Red

Prototype Pollution in mpath

Prototype Pollution in JSON5 via Parse Method

Prototype Pollution in minimist

algoliasearch-helper is vulnerable to Prototype Pollution in _merge()

Changeset vulnerable to prototype pollution

set-getter Prototype Pollution Vulnerability

AdonisJS multipart body parsing has Prototype Pollution issue

Prototype Pollution in vConsole

Prototype Pollution in locutus

Prototype Pollution in phpjs

seroval Affected by Prototype Pollution via JSON Deserialization

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

Prototype pollution in gsap

Arbitrary code execution in protobufjs

tree-kit Prototype Pollution vulnerability

Prototype Pollution in deep-get-set

Prototype Pollution in merge

OpenClaw's runtime /debug override path accepted prototype-reserved keys

Prototype Pollution in mout

Prototype Pollution in lodash

Prototype Pollution in node-oojs

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

web3-core-subscriptions has a Prototype Pollution vulnerability

node-cube vulnerable to prototype pollution

Prototype pollution in json8-merge-patch

`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`

Prototype pollution in controlled-merge

Prototype Pollution in asciitable.js

Prototype Pollution in cookiex/deep

Prototype pollution in class-transformer

Prototype Pollution in set-in

Prototype pollution in json8

Prototype Pollution in realms-shim

Prototype Pollution in dot-notes

Prototype pollution in set-in

Prototype Pollution in safe-object2

enclave-vm Vulnerable to Sandbox Escape via Host Error Prototype Chain

Malicious code in human-protocol (npm)

ion-parser Prototype Pollution when malicious INI file submitted to application that parses with `parse`

Prototype pollution in Merge-deep

thlorenz browserify-shim vulnerable to prototype pollution

Prototype pollution in grpc and @grpc/grpc-js

tschaub gh-pages vulnerable to prototype pollution

matrix-js-sdk Prototype Pollution vulnerability

deep-object-diff vulnerable to Prototype Pollution

billboard.js allows prototype pollution via the function generate

rangy vulnerable to Prototype Pollution

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Denial of Service in protobufjs

Prototype pollution in webpack loader-utils

Prototype Pollution in config-handler

Prototype Pollution in json-pointer

assign-deep Vulnerable to Prototype Pollution

Prototype Pollution in just-extend

Prototype Pollution in keyget

parse is vulnerable to prototype pollution

spmrc vulnerable to prototype pollution

dset vulnerable to prototype pollution

JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

Prototype Pollution in Dexie

Prototype pollution in total.js

Prototype Pollution in property-expr

Prototype Pollution in Dynamoose

locutus is vulnerable to Prototype Pollution

Prototype polluation in just-safe-set

Prototype Pollution in @fabiocaccamo/utils.js

Prototype Pollution in deepmerge-ts

Prototype Pollution in decal

Malicious code in @feiprotocol/fei-protocol-core (npm)

Prototype Pollution in algoliasearch-helper

apidoc-core has a prototype pollution vulnerability

Prototype Pollution in deep-override

Prototype Pollution in immer

Prototype Pollution in nconf

tough-cookie Prototype Pollution vulnerability

defu: Prototype pollution via `__proto__` key in defaults argument

steal vulnerable to Prototype Pollution via alias variable

Prototype pollution in @tsed/core

XSS via prototype pollution in NodeBB

Duplicate Advisory: Prototype Pollution in jquery

Prototype pollution vulnerability in 'deepref'

tRPC has possible prototype pollution in `experimental_nextAppDirCaller`

Prototype Pollution in assign-deep

Prototype pollution vulnerability in 'deep-set'

Redoc Prototype Pollution via `Module.mergeObjects` Component

Handlebars.js has a Prototype Method Access Control Gap via Missing __lookupSetter__ Blocklist Entry

OpenAI Codex CLI enables code execution through malicious MCP (Model Context Protocol) configuration files

Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions

Prototype Pollution in js-data

Convict has Prototype Pollution via startsWith() function

angular Prototype Pollution vulnerability

thlorenz browserify-shim vulnerable to prototype pollution

Prototype Pollution in copy-props

progressbar.js vulnerable to Prototype Pollution

matrix-react-sdk Prototype pollution vulnerability

Prototype Pollution in nedb

Prototype Pollution in immer

Prototype Pollution Vulnerability in object-collider

Prototype pollution in safe-flat

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

toggle-array vulnerable to prototype pollution

devalue has prototype pollution in devalue.parse and devalue.unflatten

uPlot Prototype Pollution vulnerability

Malicious code in dforce-protocol (npm)

keyget vulnerable to prototype pollution

Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization

Vuetify has a Prototype Pollution vulnerability

Prototype Pollution in Sails.js

Prototype Pollution in connie-lang

Prototype Pollution in node-forge

Prototype pollution in getobject

NocoDB has Prototype Pollution in Connection Test Endpoint, Leading to DoS

Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

Prototype Pollution in deephas

depath and cool-path vulnerable to Prototype Pollution via `set()` Method

Electron protocol handler browser vulnerable to Command Injection

MrSwitch hello.js vulnerable to prototype pollution

simple-git vulnerable to Remote Code Execution when enabling the ext transport protocol

Elysia Cookie Value Prototype Pollution

Unhead has XSS bypass in `useHeadSafe` via attribute name injection and case-sensitive protocol check

vue-i18n has cross-site scripting vulnerability with prototype pollution

Prototype Pollution(PP) vulnerability in setByPath

Prototype Pollution leading to Remote Code Execution in superjson

Malicious code in tellar-protocol (npm)

Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs

Leading white space bypasses protocol validation

mysql2 vulnerable to Prototype Poisoning

DOMPurify USE_PROFILES prototype pollution allows event handlers

node-opcua-alarm-condition prototype pollution vulnerability

Prototype Pollution in confucious

@stryker-mutator/util vulnerable to Prototype Pollution

Prototype Pollution in merge-recursive

Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

apidoc-core is vulnerable to prototype pollution

Prototype Pollution in simpl-schema

url-parse incorrectly parses hostname / protocol due to unstripped leading control characters.

Prototype Pollution in dotty

@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability

@nyariv/sandboxjs has Prototype Pollution vulnerability that may lead to RCE

Prototype Pollution in madlib-object-utils

Prototype Pollution in putil-merge

merge vulnerable to Prototype Pollution

Prototype pollution in object-path

js-yaml has prototype pollution in merge (<<)

Prototype pollution vulnerability in js-extend

Malicious code in @ifelsedeveloper/protocol-contracts-svm-idl (npm)

Prototype Pollution in lodash

Prototype Pollution in putil-merge

Command injection in Parse Server through prototype pollution

Prototype pollution in nested-object-assign

Prototype Pollution in y18n

js-object-utilities Vulnerable to Prototype Pollution

confinit vulnerable to prototype pollution

Prototype Pollution in jointjs

magix-combine-ex vulnerable to prototype pollution

Malicious code in seatalk-protocol (npm)

Prototype Pollution in doc-path

mockjs vulnerable to Prototype Pollution via the Util.extend function

Prototype Pollution in the merge and clone helper methods

Prototype Pollution in nodee-utils

Prototype Pollution in safetydance

JSONata expression can pollute the "Object" prototype

objection.js Prototype Pollution vulnerability

estree-util-value-to-estree allows prototype pollution in generated ESTree

Prototype pollution in paypal-adaptive

set-deep-prop Prototype Pollution

automattic/mongoose vulnerable to Prototype pollution via Schema.path

Prototype pollution in object-hierarchy-access

Malicious code in web-prototyping-tool (npm)

deep-parse-json vulnerable to Prototype Pollution

Withdrawn Advisory: fast-redact vulnerable to prototype pollution

@cdr0/sg Prototype Pollution

Prototype Pollution in gammautils

Prototype Pollution in mixin-deep

Prototype pollution in pathval

@cat5th/key-serializer Prototype Pollution vulnerability

ts-fns has prototype pollution vulnerability

@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)

deep-defaults vulnerable to prototype pollution

protobufjs Prototype Pollution vulnerability

mootools-more vulnerable to prototype pollution

Mongoose Vulnerable to Prototype Pollution in Schema Object

Prototype Pollution in mootools

steal vulnerable to Prototype Pollution via optionName variable

Prototype Pollution in irrelon-path and @irrelon/path

Prototype Pollution in object-path

Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks

Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe()

FurqanSoftware/node-whois vulnerable to Prototype Pollution

Prototype Pollution in simple-plist

Prototype Pollution in extend2

Prototype poisoning

expand-object Vulnerable to Prototype Pollution via the expand() Function

Mongoose Prototype Pollution vulnerability

Malicious code in @dydxprotocol/perpetual (npm)

Withdrawn: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in @xmldom/xmldom and xmldom

Malicious code in degate_protocols (npm)

@intlify/shared Prototype Pollution vulnerability

Prototype Pollution in deep-extend

Prototype Pollution in defaults-deep

CSVTOJSON has a prototype pollution vulnerability

dset Prototype Pollution vulnerability

dot-prop Prototype Pollution vulnerability

Prototype Pollution in async merge-object

Malicious code in lz-evm-protocol-v2 (npm)

LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set()`

Grunt-karma vulnerable to prototype pollution

Prototype pollution in safe-obj

object-deep-assign Prototype Pollution

underscore-keypath vulnerable to Prototype Pollution

express-xss-sanitizer vulnerable to Prototype Pollution via allowedTags attribute

Malicious code in appdynamics-protobuf (npm)

Prototype pollution in nestie

Prototype Pollution in field

Baobab vulnerable to Prototype Pollution

Prototype pollution in chart.js

Prototype Pollution in object-path-set

Prototype Pollution in cached-path-relative

safe-eval vulnerable to Prototype Pollution via the safeEval function

@alizeait/unflatto Prototype Pollution

jquery-plugin-query-object contains prototype pollution vulnerability

mde utilities contains Prototype Pollution

Prototype Pollution in dot-object

Malicious code in zora1abs-protoc01-sdk (npm)

Prototype Pollution in js-data

Malicious code in mozilla-protocol (npm)

Malicious code in legacycloudkitresolutionserviceprotocol (npm)

n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE

jszip Vulnerable to Prototype Pollution

Prototype Pollution in lodash

Malicious code in transform-proto-to-assign (npm)

@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution

ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse

Prototype Pollution in extend

Prototype Pollution in nis-utils

module-from-string prototype pollution

Prototype pollution in dojo

Signal K Server: Arbitrary Prototype Read via `from` Field Bypass

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

Prototype Pollution in object-extend

Path traversal and code execution via prototype vulnerability

simple-git has blockUnsafeOperationsPlugin bypass via case-insensitive protocol.allow config key enables RCE

Prototype Pollution in mixme

conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2

Prototype Pollution in ts-nodash

Prototype Pollution in deeps

datatables.net vulnerable to Prototype Pollution due to incomplete fix

Prototype Pollution in promisehelpers

dot-lens vulnerable to Prototype Pollution

Prototype Pollution in dojo

yargs-parser Vulnerable to Prototype Pollution

Hono vulnerable to Prototype Pollution possible through __proto__ key allowed in parseBody({ dot: true })

Malicious code in protocol-http (npm)

Prototype Pollution in highlight.js

Prototype Pollution in minimist

Prototype Pollution in arr-flatten-unflatten

Prototype Pollution in think-helper

Prototype Pollution in cached-path-relative

Prototype Pollution in handlebars

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Prototype Pollution in sds

Prototype Pollution

csvjson vulnerable to prototype injection

dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()

rollbar vulnerable to prototype pollution

Properties-Reader before v2.2.0 vulnerable to prototype pollution

flattenizer vulnerable to prototype pollution

Prototype Pollution in mout

dref is vulnerable to prototype pollution

Prototype Pollution in convict

body-parser-xml vulnerable to Prototype Pollution

Handlebars.js has Prototype Pollution Leading to XSS through Partial Template Injection

OpenClaw: Sandbox browser CDP relay could expose DevTools protocol on 0.0.0.0

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

Prototype Pollution in x-assign

CASL Ability is Vulnerable to Prototype Pollution

Prototype pollution in aurelia-path

Prototype Pollution in Dojox

sassdoc-extras vulnerable to prototype pollution

Prototype Pollution in mixin-deep

@ianwalter/merge Prototype Pollution via `merge` function

Prototype pollution not blocked by object-path related utilities in hoolock

DOMPurify allows tampering by prototype pollution

json-schema-ref-parser Prototype Pollution issue

Collection.js vulnerable to Prototype Pollution

tree-kit vulnerable to Prototype Pollution

Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

Malicious code in mw-proto-models (npm)

ReDoS in Sec-Websocket-Protocol header

component-flatten vulnerable to Prototype Pollution

Malicious code in @cashcowprotocol/keccak-crypto (npm)

Prototype Pollution in record-like-deep-assign

Apollo Federation vulnerable to prototype pollution via incomplete key sanitization

Malicious code in teller-protocol (npm)

steal vulnerable to Prototype Pollution

Prototype pollution in json-pointer

Prototype pollution in dotty

Prototype Pollution in merge-deep2.

Malicious code in proton-super-package (npm)

Malicious code in com.henryhoffman.unlockprotocol (npm)

devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]

`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization

Prototype Pollution in querymen

Prototype Pollution in jsgui-lang-essentials

fastest-json-copy vulnerable to Prototype Pollution

Prototype Pollution in protobufjs

Prototype Pollution Protection Bypass in qs

Prototype Pollution in bmoor

Prototype pollution in izatop bunt

Prototype pollution in swiper

Prototype Pollution in gedi

Prototype Pollution in convict

Prototype Pollution in realms-shim

Malicious code in @dydxprotocol/solo (npm)

shvl vulnerable to prototype pollution

NodeBB vulnerable to account takeover via prototype vulnerability

Prototype Pollution via parse() in NodeJS flatted

min-document vulnerable to prototype pollution

Prototype pollution in JointJS

Prototype Pollution in swiper

npm package rfc6902 vulnerable to Prototype Pollution

Prototype Pollution in lutils

Prototype Pollution in tiny-conf

Prototype Pollution in NASA Open MCT

Malicious code in compound-protocol (npm)

Malicious code in eslint-config-proton-lint (npm)

Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader

Prototype Pollution in madlib-object-utils

Malicious code in google-protobuf-conformance (npm)

steal vulnerable to Prototype Pollution via key variable in babel.js

Prototype Pollution in bodymen

vxe-table prototype pollution

Next.js is vulnerable to RCE in React flight protocol

Prototype Pollution in sds

Prototype Pollution in vm2

LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel

Prototype pollution in matrix-js-sdk (part 2)

antfu/utils vulnerable to prototype pollution

Malicious code in @asyncapi/protobuf-schema-parser (npm)

TypeORM vulnerable to MAID and Prototype Pollution

Prototype Pollution in sey

mysql2 vulnerable to Prototype Pollution

NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node

Prototype Pollution in mathjs

Prototype Pollution in handlebars

matrix-js-sdk subject to user spoofing via Olm/Megolm protocol confusion

Protocol-Relative URL Injection via Single Backslash Bypass in Angular SSR

Prototype Pollution in deepmergefn

Prototype pollution in @strikeentco/set

messageformat has a prototype pollution vulnerability

Malicious code in @protos-team/frontend-platform (npm)

Malicious code in @protos-team/frontend-primitives (npm)

Malicious code in matic-protocol (npm)

Malicious code in com.google.devtools.atsconsole.controller.proto (npm)

Malicious code in skfb-viewer-protocol (npm)

Malicious code in yandex-yt-proto (npm)

Malicious code in @tickertape/protos-pbjs (npm)

Malicious code in @protonme/routing (npm)

Malicious code in relay-prototyping-tools (npm)

Malicious code in limitd-protocol (npm)

Malicious code in omniprotocol (npm)

Malicious code in protobufjs-databricks (npm)

Malicious code in protons-benchmark (npm)

Prototype Pollution in deeply

Possible prototype pollution in metadata record, when using meta decorator

Malicious code in fei-protocol-core (npm)

Malicious code in @proto-services/banking (npm)

Prototype pollution in Plist before 3.0.5 can cause denial of service

Malicious code in protobufjs-shopee (npm)

Malicious code in proton-vpn-browser-extension (npm)

Malicious code in rlending-protocol (npm)

H3 has an Open Redirect via Protocol-Relative Path in redirectBack() Referer Validation

Malicious code in proton-parking-page (npm)

Malicious code in mw-proto-ts (npm)

Malicious code in sui-lending-protocol (npm)

Prototype Pollution in node-jsonpointer

set-in Affected by Prototype Pollution

Evolver has Prototype Pollution via `Object.assign()` in its mailbox store operations

flat vulnerable to Prototype Pollution

Prototype pollution in min-dash

Malicious code in @proto-services/integration (npm)

ag-grid packages vulnerable to Prototype Pollution

i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters

Malicious code in zora1abs-protoc-helper (npm)

SAP HANA Node.js client package vulnerable to Prototype Pollution

lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`

Convict has prototype pollution via load(), loadFile(), and schema initialization

Elysia vulnerable to prototype pollution with multiple standalone schema validation

DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback

Prototype Pollution in fullpage.js

Prototype Pollution in handlebars

Prototype Pollution via FormData Processing in Qwik City

parse-server has cloud function validator bypass via prototype chain traversal

Haraka affected by DoS via `__proto__` email header

mpregular vulnerable to prototype pollution

Malicious code in @protos-team/frontend-utils (npm)

Malicious code in protonme (npm)

Malicious code in hover-design-prototype (npm)

Malicious code in compound-protocol-alpha (npm)