Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.36 security and extras update

Red Hat OpenShift Container Platform release 4.20.36 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.31 security and extras update

Red Hat OpenShift Container Platform release 4.21.31 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

Malicious Package

Overview kisama-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

PT-2026-84523

Name of the Vulnerable Software and Affected Versions js-yaml versions 3.0.0 through 3.15.1 js-yaml versions prior to 4.3.2 Description An issue exists where maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js fails to count empty mapping sources when processing the merge key . This allo...

CVE-2026-84375: Uncontrolled Resource Consumption

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key . An attacker can alias a large sequence of empty mappings into many merge...

MAL-2026-15645 Malicious code in kisama-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0179b9fe97920f04431eb6d6e94b46c6ef2889af5e55d6a0b79793097187fed3 [email protected] ships an obfuscated index.js that runs an HTTP+WebSocket agent binding 0.0.0.0:8000 by default and exposing /api/exec POST for shell...

Malicious code in kisama-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0179b9fe97920f04431eb6d6e94b46c6ef2889af5e55d6a0b79793097187fed3 [email protected] ships an obfuscated index.js that runs an HTTP+WebSocket agent binding 0.0.0.0:8000 by default and exposing /api/exec POST for shell...

Malicious code in eslint-prettier-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c75af75154da75ac5073b9dcea65c04bdb3f493f3a72d79f1847df90bf449 The package's postinstall hook runs index.cjs's onInstall, which performs await fetch"https://2939e69fc408.ngrok-free.app/stats" and passes the...

MAL-2026-15601 Malicious code in eslint-prettier-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c75af75154da75ac5073b9dcea65c04bdb3f493f3a72d79f1847df90bf449 The package's postinstall hook runs index.cjs's onInstall, which performs await fetch"https://2939e69fc408.ngrok-free.app/stats" and passes the...

CVE-2026-81887: Improper Neutralization of Input During Web Page Generation

Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString and insertDotNotatedValueIntoData, accepts the proto, constructor, and prototype path segments and creates inherit...

CVE-2026-82813: Insufficient Verification of Data Authenticity

A vulnerability was detected in BEN Group TubeBuddy for YouTube Extension up to 5.8.4 on Chrome. This impacts the function TBGlobal.GetToken of the file tubebuddymaster1.js. The manipulation of the argument t/c/r results in insufficient verification of data authenticity. It is possible to launch...

PT-2026-89555

Root has patched GHSA-8j8c-7jfh-h6hx in the js-yaml package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview eslint-prettier-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

AZL-98331 CVE-2026-82417 affecting package js-jquery 3.5.0-4

Summary qs.stringify throws a TypeError when it serializes an object whose own constructor property has a truthy, non-callable isBuffer member. utils.isBuffer duck-types buffers by calling obj.constructor.isBufferobj after checking only that the property is truthy, so a value such as constructor:...

Malicious Package

Overview js-array-tokens is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview js-tokens-array is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15556 Malicious code in js-tokens-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f8ed5536e88f2c77c432b868367e25dea9244052779e825999e6e4324dcc35b index.js runs getToken at module load time. The destination URL is reconstructed from a numeric char-code array via String.fromCharCode to hide it fr...

Malicious code in js-tokens-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f8ed5536e88f2c77c432b868367e25dea9244052779e825999e6e4324dcc35b index.js runs getToken at module load time. The destination URL is reconstructed from a numeric char-code array via String.fromCharCode to hide it fr...

Malicious code in js-array-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...

MAL-2026-15555 Malicious code in js-array-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...