Malicious code in boring-vault (npm)

boring-vault is a malicious npm package that impersonates the BoringVault smart-contract framework. It carries no legitimate functionality; the published tarball contains only a package.json and an install-time payload index.js. Both preinstall and postinstall run node index.js || true, so the co...

Malicious code in permit2 (npm)

permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system whose legitimate npm distribution is the scoped @uniswap/permit2-sdk, advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published...

CVE-2026-72590 alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

EUVD-2026-55216

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

Linux Environment Variable Enumeration

Enumerates environment variables at the SYSTEM and USER scope on Linux. SYSTEM-scope variables are collected from /etc/environment, /etc/security/pamenv.conf, /usr/share/pam/security/pamenv.conf and shell scripts under /etc/profile.d/ plus /etc/profile and /etc/bashrc. USER-scope variables are...

Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

MAL-2026-13666 Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

Malicious code in @catamania/front-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b66b93df02350bdf848ac2cff8c6a563ac36c1828480891381875453be67f5 The package's postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.userInfo username, process.cwd...

MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

MAL-2026-13599 Malicious code in dolyame-ui-sortablelist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7 On require the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev, host strings...

Malicious code in dolyame-ui-sortablelist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7 On require the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev, host strings...

Malicious code in ded-pwa-test-pub-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1383d653a37b7e74a16850e3c1bf474ca310c0755505f3efd7f613ba0e553e08 On module load, index.js requires./compat.js which assembles remote hostnames from split string literals e.g...

OESA-2026-3251 python-GitPython security update

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. Security Fixes: GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clonefrom. The caller-supplied remote URL is passed through...

Craft CMS: Authenticated leak of secret environment variables

Environment variables and secrets are interpolated into a Twig template even when the Twig sandbox is enabled, allowing them to be leaked by an authenticated attacker. The Craft vulnerability CVE-2026-31857 was only patched by applying sandboxed Twig templating. This theoretically protects Craft...

GHSA-596P-6JV8-775V Craft CMS: Authenticated leak of secret environment variables

Environment variables and secrets are interpolated into a Twig template even when the Twig sandbox is enabled, allowing them to be leaked by an authenticated attacker. The Craft vulnerability CVE-2026-31857 was only patched by applying sandboxed Twig templating. This theoretically protects Craft...

Exposure of Resource to Wrong Sphere

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the elementId parameter, which allows interpolation of environment variables and secrets into a Twig template even when the Twig sandbox is enabled. A...

Malicious code in poc-ch4rlygr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04 On require/import, index.js collects os.hostname, os.arch, dirname, os.userInfo.username, and the full contents of process.env serialized via...

MAL-2026-13454 Malicious code in poc-ch4rlygr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04 On require/import, index.js collects os.hostname, os.arch, dirname, os.userInfo.username, and the full contents of process.env serialized via...

Malicious code in @ks-video/kwai-player-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189f106b356a246462f37d1199e1be9191a00724014f74d1ac2a39c94c5a8222 On npm install, the package's postinstall hook runs scripts/telemetry.js, which collects installer-side reconnaissance — os.hostname,...