Malicious code in tinymember (crates.io)

tinymember is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carrying a...

CVE-2026-18299: Use After Free

GStreamer rtpsbcdepay Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

Malicious code in proc_macro_en (crates.io)

proc-macro-en is a malicious crate published to crates.io as part of the coordinated build-time payload campaign on 2026-08-20 that trojanized arrayref, internment, and append-only-vec and published the proc-macro1 typosquat of proc-macro2. It was used as an attacker-controlled dependency carryin...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the decodeNativeFormat. An attacker can inject arbitrary entries into MessageHeaders, including sensitive control headers, by sending...

CVE-2026-76342

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store risky Search Processing Language SPL commands in a Table Editor dataset and share the dataset. A user who holds the "admin" Splunk role triggers the commands when that user...

EUVD-2026-62710

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip in client/lib/exportHTML.js read a card title and body through textContent, which decoded entity-encoded markup, and then interpolated titleText and allText into content.innerHTML in the exported index.html. A...

CVE-2026-63640

A flaw was found in MagicMirror². When the hideConfigSecrets feature is enabled, a connected client can submit a secret placeholder in a socket payload. This causes the server to incorrectly expand the placeholder with sensitive environment variables, such as API tokens or credentials. This...

MAL-2026-14302 Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

tablib: Stored XSS in the HTML export via unescaped dataset title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

Malicious code in anhn-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0f11f74231c27bd3e3ac41dea5290466f042224f64547d88a328d6b87cf657 bin/install/install.js appends a heavily obfuscated top-level IIFE obfuscator.io-style rotated string array 0x240a/0x4963 with arithmetic index...

Malicious code in @wizloft/harness-plugin-repository-files (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a...

Malicious code in @wizloft/harness-kernel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d73d94752604c9b48dd785c20cee875e268bb52c673bf3817f95000830fa85 dist/index.js contains an obfuscated top-level async IIFE that executes on import. It queries Ethereum JSON-RPC endpoints eth.drpc.org,...

Malicious code in @wizloft/harness-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b0fc0f25eb3d7852b52d7e7db50071ac08ddfb1965df306bbf87ebf295cbe1 dist/index.js appends a heavily obfuscated obfuscator.io-style payload string array 0x240a of length 303, decoder 0x4963, string-array rotation after...

Malicious code in @wizloft/harness (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of...

Malicious code in @wizloft/harness-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554 dist/index.js the package's declared main contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. ...

MAL-2026-14277 Malicious code in o0o9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118 The package's main entry index.js imports childprocess at the top of the file and invokes spawn"powershell",... as a top-level side effect line 27...

MAL-2026-14261 Malicious code in postcss-initialize-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85729e0f775f02486ef631437f648a1661eced789fa66656248f9d4078ac3f16 [email protected] presents itself as a PostCSS plugin README, badges, and repository links reference the legitimate...

Malicious code in ranux-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c2844c37c95371d0fa96d0a814be948335590d5b65500a8f4b2a577c8748e23 The package main index.js is obfuscator.io-transformed with a rotated string-array decoder and, at top level, uses createDecipheriv with a hardcoded...

MAL-2026-14250 Malicious code in luluking1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4 index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply,...

Malicious code in ts-rand-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f3c43a89866228b5365b9e318da3ea953bb2c5b7da94136d887359e8e1f07a8 Package presents itself as a random transactions SDK exposing a single API, getTransactionscount. Following that documented usage triggers a hidden...