Malicious code in velabuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa899acd5a63682964770cb32c4f0707008c9f3894ca6f5cacd222de74f03cea cli.js embeds a base64-encoded RSA private key in CONFIG.encodedSSHKey, decodes it to a temp file with mode 0o600, and uses it to ssh -o...

Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

MAL-2026-13475 Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

MAL-2026-13476 Malicious code in sui-migration-audit-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde60caa9a24d7775679269b1c468e4d2aa850e819104cd66c25dde8fb6931af Package [email protected] contains 2 scanned files. No install-time lifecycle hooks, credential access, network exfiltration, dropper,...

Malicious code in svelte-visual-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13b68e25df054313067ca459b865ea19afd38a9c4b8c90a02a6f56bd4475cf6f No a static rule matches and no traced behaviors of concern were identified in this package version. The tarball does not exhibit lifecycle-script...

Malicious code in @diezyyasha/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd6b728a9ecc8547f7199d74cfc1070334a586f5fd7fed6e87e332b70945c733 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-13474 Malicious code in @diezyyasha/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd6b728a9ecc8547f7199d74cfc1070334a586f5fd7fed6e87e332b70945c733 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2026-53858

In Apache CXF's DefaultEncryptingCodeDataProvider, a captured authorization code can be redeemed an unlimited number of times due to a flaw in the implementation of the removeCodeGrant functionality. This violates the RFC requirement that "The authorization code MUST NOT be used more than once."...

CVE-2026-64595 HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove()

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

CVE-2026-64595

HID: hid-lenovo-go suffered a race where a 2 ms delayed work (cfg_setup) could run after hid_destroy_device() releases hdev. The fix mirrors hid-lenovo-go-s.c by calling cancel_delayed_work_sync() and draining go_cfg_setup at hid_go_cfg_remove(), with cancellation occurring before acquiring cfg_m...

CVE-2026-64595

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

remove-ai-watermarks v0.26.0

Remove AI Watermarks Remove AI provenance marks from images and video you generated yourself: known visible labels such as the Gemini sparkle and vendor text marks; invisible pixel watermarks through diffusion regeneration; C2PA, EXIF, XMP, IPTC, and related AI metadata. Video support covers...

Malicious code in @zahlen/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...

Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

MAL-2026-13391 Malicious code in @zahlen/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...

MAL-2026-13389 Malicious code in @voxepay/checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...

MAL-2026-13387 Malicious code in @afasinatickets/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2eaa8543223afa988f2c6782fb481354f16cafdb28fac01b9221e4c97a2f2f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2026-66754

Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...