Advisories · 6

Security advisories

Verified supply-chain findings — every case is disclosed to the maintainer first and its identity revealed only after a coordinated-disclosure deadline. Credential values are always redacted.

1 further advisory is under disclosure embargo — the maintainers have been notified and the details are withheld until each deadline passes.

CLR-2026-2994 Critical

logger-daemon-regex

npm · 1.0.124

Disclosed 2026-07-05 · published (detected 2026-07-01)

CLR-2026-2990 Critical

datefmt-helper

npm · 1.0.0

Disclosed 2026-07-02 · 10:03 UTC

CLR-2026-2991 Critical

fmt-date-lite

npm · 1.0.0

Disclosed 2026-07-01 · 12:59 UTC

CLR-2026-2989 Critical

coral-wraith

npm · 1.0.8

Disclosed 2026-06-30 · 23:20 UTC

CLR-2026-2993 Critical

colorpicker-ui

npm · 1.2.5

Disclosed OSV MAL-2026-6473 · 2026-06-25

CLR-2026-2988 Critical

zod-pino

npm · 1.0.127

Disclosed 2026-06-24 · 00:02 UTC