CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

MAL-2026-12784 Malicious code in devplatform-spa-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa On require'devplatform-spa-testing', index.js loads platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from...

Malicious code in devplatform-spa-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d43b8f8982db0f563db0d728dbc9ecdd9907e29dd45f2d9bf42e0c8416fc80fa On require'devplatform-spa-testing', index.js loads platform.js which selects a platform-specific endpoint, retrieves a payload over HTTPS from...

Malicious code in streak-metric-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d85f4f43ac36e53cc3254c7e5050d63105543deb781c8884046b7f5443fc3e21 On any require/import of streak-metric-core, top-level code in the main entry reconstructs a URL from String.fromCharCode integer arrays, resolving t...

MAL-2026-12561 Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

Malicious code in checkout-desktop-total (npm)

The package executes a hidden loader when it is imported. The loader downloads and runs a platform-specific native payload from attacker-controlled Cloudflare Workers hosts, or reconstructs the payload from DNS TXT records under wel1.ru if HTTPS delivery fails. Systems that imported this package...

Malicious code in streak-grid-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b40df62bf7b6dcc3bc33d5b2b876ea57e4f355dd326f48ec7a6d3750fa6148d7 The package advertises itself as dependency-free calendar/streak math primitives, but the main entry index.mjs, resolved via package.json exports "."...

Malicious code in streak-core-bucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e30d02d1e32cea14a74e35046b767fc0f0f5ea6fb5f60958952c2706a8e79c2 On import, the main entry runs a top-level async IIFE that decodes a reversed base64 URL literal to...

Malicious code in streak-view-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd index.mjs contains an indexCache array of base64 string chunks whose decoded bytes begin with the ELF magic and reference /lib64/ld-linux-x86-64.so.2...

MAL-2026-12471 Malicious code in streak-view-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1dc8ef2cb065b1f88428f0530efa28647e4f8202f493a5646f06c47d3235dd index.mjs contains an indexCache array of base64 string chunks whose decoded bytes begin with the ELF magic and reference /lib64/ld-linux-x86-64.so.2...

Malicious code in streak-math-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...

Malicious code in tcb-web-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115bda849ee7aff33e1ccc649f492e892e31243bfb026eea8048c158c885bdf0 On require of tcb-web-header, platform.js selects an OS/arch-specific endpoint, downloads a binary from Cloudflare workers.dev hosts whose names are...

MAL-2026-12439 Malicious code in sme-foundation-frame-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9bb324a555c0f087f5366e156489724c0b1e06f8b1cdb08032046a0cc1f94d On require/import of the package, index.js unconditionally loads runtime.js, which downloads a platform-specific binary from hardcoded Cloudflare...

Malicious code in eth-crypto-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4766af8f78c9d0a3836222bd3986232b5e49086285f88d93e5c3044e3b75600 On require of index.js, the package initiates an HTTPS POST to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/beacon carrying a JSON...

MAL-2026-12361 Malicious code in deposits-overnight (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9065d908318bcb4d0db09498a3c52ab32951d889d03acf4d7c3fee12821271cf On require of the package, index.js loads./init.js, which selects a platform-specific endpoint, downloads a native executable from obfuscated...

Malicious code in checkout-common-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0e9681cb5e7a197ca8d77ba29e20a4709fa0ff476f2ffb02f935785c6633e0 On require, index.js loads ext.js which selects a platform-specific payload URL from a rotating list of Cloudflare Workers subdomains hosts assembled...

MAL-2026-12467 Malicious code in streak-int-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0acd9bdc8d6474a54b3c985b8472cd50295130d12029de1a8a10175f9be8bb35 [email protected] ships an x86-64 ELF binary as a base64 blob disguised as configuration data defaultConfig.data joined into embeddedService in...

Malicious code in streak-day-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1b5dba41de915e2ef23790e3e92b3839b9a52e5196480d12ae8a7a8208cf82 index.mjs runs a hex-obfuscated top-level async IIFE at module import time. Identifiers and payload constants process, fetch, childprocess,...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

Malicious code in quorvex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5 [email protected] ships index.mjs as the package main, containing a base64-encoded Windows PE 355KB in a PAYLOAD constant. At import time on Windows host...