Malicious code in paysafe-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b2f9f90c8f2efd9e304e6ab0271ac2378954fe724134b4daa4649622a0f416 The package presents itself as a Paysafe payments SDK PaysafeClient with payments.create/get and customers.create/get methods but its index.js contai...

Malicious code in paysafe-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2877a8bf5626e24e7e65c02d1ba6d5f27be7d7367079e0e3065f95775e31f7f7 The package presents itself as a Node.js client for the Paysafe REST API but its main entry ships an XOR-obfuscated stealer. When any advertised SDK...

MAL-2026-10171 Malicious code in paysafe-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2877a8bf5626e24e7e65c02d1ba6d5f27be7d7367079e0e3065f95775e31f7f7 The package presents itself as a Node.js client for the Paysafe REST API but its main entry ships an XOR-obfuscated stealer. When any advertised SDK...

Malicious code in paysafe-fraud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a596646a3604e01bef558573fc7199a2b9e9cc07ab7edae1b7e445d2e2b860b6 Package advertises itself as the 'Paysafe Fraud Prevention SDK' name paysafe-fraud, repo github.com/paysafe/paysafe-fraud but the exported...

MAL-2026-10168 Malicious code in paysafe-fraud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a596646a3604e01bef558573fc7199a2b9e9cc07ab7edae1b7e445d2e2b860b6 Package advertises itself as the 'Paysafe Fraud Prevention SDK' name paysafe-fraud, repo github.com/paysafe/paysafe-fraud but the exported...

Malicious code in paysafe-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1dc1a7847e47ee850fe8a4011ce83950962ab65cc742eb52919d13abe431e59 [email protected] impersonates a Paysafe payments SDK package name, description "Paysafe JavaScript SDK", and repository URL...

MAL-2026-10167 Malicious code in paysafe-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4db76c1b389e2c8d019eda8a0b6f3b8c28193fd3f9de4abe6234bab1e595e619 Package presents itself as a Paysafe Checkout SDK but is a credential-stealing lure. index.js defines a PaysafeClient with fake payments/customers AP...

Malicious code in notify-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9cbb2ac45124e3844e29f3efd70ca26f0089ec4eaad718bcbdaf3035ec9b34b The package impersonates the pino logger API exports module.exports.pino = middleware, ships pino-style files such as lib/proto.js, lib/multistream.j...

Rambert

Rambert...

CVE-2026-61437 PraisonAI before 1.6.78 Remote Code Execution via tools.py

PraisonAI pip package praisonaiagents before 1.6.78 contains an unsafe dynamic module loading vulnerability in AgentFlow.resolvepydanticclass src/praisonai-agents/praisonaiagents/workflows/workflows.py. When a workflow step uses a string outputpydantic reference, the framework locates and imports...

RockyLinux 10 : podman (RLSA-2026:37072)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:37072 advisory. golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate CVE-2026-39835 golang.org/x/crypto/ssh:...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in admin-api.ts, which mounts the admin API on the same listener as user-defined mock routes enabled by default via packages/cli/src/commands/start.ts and...

Missing Authentication for Critical Function

Overview @mockoon/cli is a Mockoon's CLI. Deploy your mock APIs anywhere. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in admin-api.ts, which mounts the admin API on the same listener as user-defined mock routes enabled by default via...

CVE-2026-59148

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: with write methods...

CVE-2026-59148 Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: with write methods...

CVE-2026-59148 Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: with write methods...

Malicious code in nonenull1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 162cd9e0496d35e0500fe084f6011a3e6893182b0fa209502c5d6017ab1138ac The package declares gypfile: true with no native C/C++ sources, and its binding.gyp abuses GYP command-expansion syntax in the sources list — !node...

Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

MAL-2026-10078 Malicious code in vybscan-testbed-inert-postinstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4e6f35e49b7701bb75a88eb63fcf918c389272d5282093c8422d9e1f388dd38 package.json declares a postinstall lifecycle script that runs id and reads the process environment, piping the collected host identity and environme...

MAL-2026-10044 Malicious code in chai-as-serialized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e48e8980927471640c6573406d988d1a4361759f14a952da36c5daa1c9fd3c The package's main entry index.js spawns a detached node child process running lib/initializeCaller.js as a side effect of invoking the exported...