MAL-2026-11481 Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...

Malicious code in sap-mcp-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd73a0cce0624f18914a46c4fd174111ed722c842cd0d664a16299ac145385ce The package name suggests an SAP MCP configuration helper ships lib/report.js which, from a postinstall hook, collects developer identity data — emai...

Malicious Package

Overview sap-mcp-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-41850 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry...

GHSA-9F52-RJQV-25QV vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry...

GHSA-WXPP-56Q6-5PCG vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry...

GHSA-R5W3-XV2F-J59Q vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry...

CVE-2026-41848 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry...

CVE-2026-41851 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry...

CVE-2026-41852 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, zipkin, apache-nifi-registry...

GHSA-9F52-RJQV-25QV vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, camunda-zeebe, apache-nifi-registry, kafbat-ui-fips, camunda, zipkin, apache-activemq, keycloak-config-cli, apache-camel-karavan-devmode, kafbat-ui, jenkins...

GHSA-WXPP-56Q6-5PCG vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, camunda-zeebe, apache-nifi-registry, kafbat-ui-fips, camunda, zipkin, apache-activemq, keycloak-config-cli, apache-camel-karavan-devmode, kafbat-ui, jenkins...

CVE-2026-41851 vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, camunda-zeebe, apache-nifi-registry, kafbat-ui-fips, camunda, zipkin, apache-activemq, keycloak-config-cli, apache-camel-karavan-devmode, kafbat-ui, jenkins...

CVE-2026-41852 vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, camunda-zeebe, apache-nifi-registry, kafbat-ui-fips, camunda, zipkin, apache-activemq, keycloak-config-cli, apache-camel-karavan-devmode, kafbat-ui, jenkins...

CVE-2026-41848 vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, camunda-zeebe, apache-nifi-registry, kafbat-ui-fips, camunda, zipkin, apache-activemq, keycloak-config-cli, apache-camel-karavan-devmode, kafbat-ui, jenkins...

CVE-2026-41850 vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, camunda-zeebe, apache-nifi-registry, kafbat-ui-fips, camunda, zipkin, apache-activemq, keycloak-config-cli, apache-camel-karavan-devmode, kafbat-ui, jenkins...

GHSA-R5W3-XV2F-J59Q vulnerabilities

Vulnerabilities for packages: apache-activemq-fips, camunda-zeebe, apache-nifi-registry, kafbat-ui-fips, camunda, zipkin, apache-activemq, keycloak-config-cli, apache-camel-karavan-devmode, kafbat-ui, jenkins...

Jodit has prototype pollution via Jodit.configure() / ConfigMerge

Summary Jodit.configureoptions — and the internal ConfigMerge / ConfigProto helpers — merged user-supplied options into the editor configuration without filtering prototype-mutating keys. A payload nested under an existing plain-object option such as controls could reach and mutate Object.prototy...

NPM: Jodit has prototype pollution via Jodit.configure() / ConfigMerge

NPM: Jodit has prototype pollution via Jodit.configure / ConfigMerge vulnerability discovered by ? in WordPress Npm jodit versions 4.12.18...

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Summary The ALLOWEDSOURCES configuration is meant to restrict which hosts Thumbor's HTTP loader may fetch images from. Plain-string entries in that list the overwhelming majority of real-world and documented configurations are passed directly to re.match without escaping. Because . is a regex...