Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

Source: amazon-inspector ffdc9c111498bf0f75d014ef58b811df488c9014addfb1ed64f7ab28cf9c11b1 On require'@galicia-toolkit-nestjs-20/paas', index.js unconditionally loads prebuilds/-/metrics.node at module top level inside a try/catch. The shipped ELF addon reads AWSACCESSKEYID, AWSSECRETACCESSKEY,...

CVE-2026-4035: Insertion of Sensitive Information Into Sent Data

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the apikey field in...