color-name@2.0.1 contains malware after npm account takeover
npm color-name · Upgrade to 2.0.2 or later · >= 2.0.1, < 2.0.2 · CVE-2025-59145 · GHSA-5fvm-p68v-5wmh · amended
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
npm color-name · Upgrade to 2.0.2 or later · >= 2.0.1, < 2.0.2 · CVE-2025-59145 · GHSA-5fvm-p68v-5wmh · amended
npm debug · Upgrade to 4.4.3 or later · >= 4.4.2, < 4.4.3 · CVE-2025-59144 · GHSA-4x49-vf9v-38px · amended
npm color · Upgrade to 5.0.2 or later · >= 5.0.1, < 5.0.2 · CVE-2025-59143 · GHSA-qrmh-qg46-72pp · amended
npm color-string · Upgrade to 2.1.2 or later · >= 2.1.1, < 2.1.2 · CVE-2025-59142 · GHSA-286p-vc9p-p5qv · amended
npm simple-swizzle · Upgrade to 0.2.4 or later · >= 0.2.3, < 0.2.4 · CVE-2025-59141 · GHSA-9g9j-rggx-7fmg · amended
npm backslash · Upgrade to 0.2.2 or later · >= 0.2.1, < 0.2.2 · CVE-2025-59140 · GHSA-53mq-f4w3-f7qv · amended
npm flowise · Upgrade to 3.0.6 or later · >= 2.2.7-patch.1, < 3.0.6 · CVE-2025-71336 · GHSA-6933-jpx5-q87q · amended
npm flowise · Upgrade to 3.0.6 or later · >= 2.2.8, < 3.0.6 · CVE-2025-71334 · GHSA-q67q-549q-p849 · amended
npm flowise · Upgrade to 3.0.6 or later · >= 3.0.5, <= 3.0.5 · CVE-2025-71324 · GHSA-99pg-hqvx-r4gf · amended
npm flowise · Upgrade to 3.0.6 or later · >= 3.0.5, <= 3.0.5 · CVE-2025-59528 · GHSA-3gcm-f6qx-ff7p · amended
npm flowise · Upgrade to 3.0.6 or later · >= 3.0.5, <= 3.0.5 · CVE-2025-59527 · GHSA-hr92-4q35-4j3m · amended
npm flowise · Upgrade to 3.0.6 or later · >= 3.0.5, <= 3.0.5 · CVE-2025-57164 · GHSA-7944-7c6r-55vv · amended
crates.io fuser · Upgrade to 0.16.0 or later · < 0.16.0 · GHSA-cvmj-47v9-35m9
Go github.com/envoyproxy/envoy · Upgrade to 1.35.1 or 1.34.5 by release line · >= 1.35.0, <= 1.35.0; >= 1.34.0, < 1.34.5 · CVE-2025-54588 · GHSA-g9vw-6pvx-7gmw
crates.io fast-able · Upgrade to 1.13.7 or later · < 1.13.7 · GHSA-95hm-pr6q-298w
Go github.com/chaos-mesh/chaos-mesh · Upgrade to 2.7.3 or later · < 2.7.3 · CVE-2025-59358 · GHSA-2gg8-85m5-8r2p
Go github.com/chaos-mesh/chaos-mesh · Upgrade to 2.7.3 or later · < 2.7.3 · CVE-2025-59360 · GHSA-xv9f-728h-9jgv
Go github.com/chaos-mesh/chaos-mesh · Upgrade to 2.7.3 or later · < 2.7.3 · CVE-2025-59359 · GHSA-369h-6j28-wwcg
Go github.com/mattermost/mattermost/server/v8 · Upgrade to 8.0.0-20250731063404-9eebaadf8f72 (pre-release) or later · < 8.0.0-20250731063404-9eebaadf8f72 · +1 more package · CVE-2025-9072 · GHSA-69j8-prx2-vx98
Go github.com/chaos-mesh/chaos-mesh · Upgrade to 2.7.3 or later · < 2.7.3 · CVE-2025-59361 · GHSA-2gcv-3qpf-c5qr
Maven com.liferay:com.liferay.portal.vulcan.impl · Upgrade to 5.0.105 or later · >= 5.0.7, < 5.0.105 · +1 more package · CVE-2025-43796 · GHSA-f3hf-r62c-mfrj
npm flowise · Upgrade to 3.0.6 or later · <= 3.0.5 · CVE-2025-58434 · GHSA-wgpv-6j63-x5ph · amended
PyPI mcp-neo4j-cypher · Upgrade to 0.4.0 or later · >= 0.2.2, < 0.4.0 · CVE-2025-10193 · GHSA-vcqx-v2mg-7chx · amended
npm axios · Upgrade to 1.12.0 or 0.30.2 by release line · >= 1.0.0, < 1.12.0; >= 0.28.0, < 0.30.2 · CVE-2025-58754 · GHSA-4hjh-wcwx-xvwj · amended
Maven com.liferay:com.liferay.object.service · Upgrade to 1.0.197 or later · < 1.0.197 · CVE-2025-43790 · GHSA-5wxc-3jfw-w94p
A vendor fix does not resolve your finding until you verify it in your own systems.
Security reports that are not matched to your stack.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
Listed as news: the source report lacks affected versions, a fix, or verified evidence.