CVE-2026-69192

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-69198

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing CIDR suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such a...

CVE-2026-48912

An Improper Input Validation vulnerability exists in Apache Answer versions up to and including 2.0.1 . The root cause is a missing ownership check within the avatar-cleanup logic , which allows any authenticated user to delete uploaded files belonging to other users by providing specific file UR...

CVE-2026-48912 Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL

Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs. Users are recommended to upgrade to...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-6790

A flaw was found in Eclipse Jetty. The server does not strictly validate that the request authority host and port matches the Host header provided in HTTP/1, HTTP/2, and HTTP/3 requests. This improper validation can lead to various issues, including incorrect handling of URI constructions for...

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control C2 technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two...

Malicious code in dc-renewals-layout2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113 The package's preinstall script auto-runs on npm install and issues a plaintext HTTP GET to http://75.119.137.232:31337/depconfuse carrying the...

MAL-2026-12671 Malicious code in dc-renewals-layout2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113 The package's preinstall script auto-runs on npm install and issues a plaintext HTTP GET to http://75.119.137.232:31337/depconfuse carrying the...

MAL-2026-12815 Malicious code in widget-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8 [email protected] is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install...

Malicious code in widget-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8 [email protected] is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install...

Malicious code in ts-toolkit-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49d47be3f5dc16ea70755e0233f46106d3f50d1d5384a4f20c76b91463c9876c The package's main entry defines a getPlugin function that performs an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/112...

Malicious code in sc-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b75d6f50386e1c630638fb334a8de08ad5fd2e1b7811ce63e2c6a64d7e3a09 [email protected] declares a preinstall script that executes callback.js on npm install. The script collects host identity os.hostname,...

Malicious code in dust-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e08146748974a55b50e565bc0ae7fc1788c9b8a28858536c697505032334310 On npm install, the package's preinstall script runs node callback.js, which collects os.hostname, os.userInfo.username, process.cwd,...

MAL-2026-12666 Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

Malicious code in crypto-checkout-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15806df14aa955b2d5e08414d4f22ad71a9d1ac823aa7557e8f9d490d78761d index.js exports getPlugin which issues an HTTPS request to a hardcoded bare-IP endpoint at https://46.183.25.232:45000/icons/112 and passes the...

MAL-2026-12514 Malicious code in async-mutex-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 699abe52cb380ae997f200e0615bfce84cd52d11b98a54244ce5b30478fab336 Package name typosquats async-mutex but ships unrelated functionality. The default export getPlugin in index.js issues an HTTP request to a hardcoded...

Malicious code in poly-bbc-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb49d43833628610acae14ea039bb3a490dc94ec90bd8faac084a977a8f8ebd The package's exported getPlugin function issues an HTTPS request to the hardcoded bare-IP endpoint https://46.183.25.232:45000/icons/107 and passes...

Malicious code in sc-font-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8c91edd839dd00f2e58ad9296742f8c3c5ff126523bbd8ed7561fef7c8516e The package's preinstall script runs automatically on npm install and collects installer-side identifiers — os.hostname, os.userInfo.username,...

MAL-2026-12800 Malicious code in sc-font-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8c91edd839dd00f2e58ad9296742f8c3c5ff126523bbd8ed7561fef7c8516e The package's preinstall script runs automatically on npm install and collects installer-side identifiers — os.hostname, os.userInfo.username,...