Malicious code in cursed-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...

MAL-2026-6674 Malicious code in ripshakti1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 764edbf390c427ef99a9d9164034b966fbac251f00240bbb219825c0c92422a6 package.json declares a preinstall lifecycle hook node index.js that auto-executes on npm install. index.js queries the AWS EC2 instance metadata...

Malicious code in log-taker1 (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. log-taker1 embeds a full infostealer 2800 lines directly in index.js, executed at install time via postinstall: node test.js. The payload harvests cryptocurrency wallet vaults MetaMask, Phantom, Solflare,...

MAL-2026-6691 Malicious code in polymarket-clob-maths (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-clob-maths uses a dropper technique: a postinstall hook fetches a remote bundle from trabalhos-flax.vercel.app and executes a syncSession function that runs a...

Malicious code in ts-bn-proto (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign. ts-bn-proto embeds an infostealer payload directly in index.js with a base64-encoded C2 address data-stream.space, executed at install time via a postinstall hook. The payload harvests cryptocurrency wallet...

MAL-2026-6692 Malicious code in polymarket-trading-developer-tools (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-trading-developer-tools uses a dropper technique: a postinstall hook downloads configuration from pm-trading-dev-tools-be.vercel.app and exfiltrates data to the...

PYSEC-2026-384 Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Vulnerability Summary Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via...

PYSEC-2026-339 FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...

MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:2643-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2643-1 advisory. This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385:...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: policy-controller, tekton-chains, ko, ko-fips, spire-server, neuvector-sigstore-interface-fips, gitsign, trivy-operator, kubescape-server, kyverno-notation-aws, falcoctl-fips, tbot, tflint, kubescape, chainctl-fips, crossplane, docker-fips, ratify-fips, zarf,...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: policy-controller, tekton-chains, ko, ko-fips, spire-server, neuvector-sigstore-interface-fips, gitsign, trivy-operator, kubescape-server, kyverno-notation-aws, falcoctl-fips, tbot, tflint, kubescape, chainctl-fips, crossplane, docker-fips, ratify-fips, zarf,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: calico-fips, kaf, frankenphp-8.5, kube-state-metrics, omnictl-multiarch, spire-server, upwind-agent, docker-machine-driver-harvester, skaffold-fips, trivy-operator, argo-cd-fips, minio-fips, terraform, kine, argo-workflows-fips, k9s-fips, tigera-operator,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ssm, crossplane-provider-aws-wafv2, chainloop-control-plane-fips, kargo, frankenphp-8.5, crossplane-provider-aws-guardduty, argo-events-fips, upwind-agent, cloudflared, crossplane-provider-aws-ec2-fips, crossplane-provider-azure-servicebus,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: argo-cd, crossplane-provider-azure-managedidentity, kubernetes-dashboard, chisel, gptscript, cilium, nuclei, kargo, fulcio, skaffold, gomplate, scorecard, vault-benchmark, buildkitd, melange, cilium-cli, step-issuer, atlantis, guac, age, flux, splunk-otel-collector,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: trivy, spire-server, nerdctl, kubernetes-dashboard, chisel, kine, cilium, mattermost, argocd-image-updater, prometheus, fscrypt, kaf, k3s, skaffold, istio, prometheus-operator, knative-serving, flux-source-controller, kyverno, gitea, containerd, kubernetes, cilium-cl...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: argo-cd, kubernetes-dashboard, gptscript, cilium, nuclei, skaffold, gomplate, scorecard, melange, cilium-cli, step-issuer, guac, flux, zarf, apko, opentelemetry-collector, helm, opentofu, trivy-operator, witness, osv-scanner, syft, dagger, nerdctl, kine,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: spire-server, nerdctl, kubernetes-dashboard, kine, cilium, mattermost, buildah, fscrypt, prometheus, kaf, k3s, podman, istio, prometheus-operator, knative-serving, kyverno, containerd, kubernetes, cilium-cli, zot, cert-manager, cloud-provider-aws, flux, gitlab-kas,...

Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues CVE-2022-1996: CORS bypass bsc1200528. CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. CVE-2025-47910: net/http:...

SUSE-SU-2026:2643-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. - CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. - CVE-2025-47910: net/http:...