MAL-2026-198 Malicious code in shopee-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ba8299c56484696126f8c09607e181246e87dd9c5f6a18cee51aec5d1f5ddd8 The package shopee-chat was found to contain malicious code. Source: ghsa-malware 052cf5d16ba6c226e8563598b02f71cc8f9bddb733c4074426526c4e860c66b8 An...

Malicious code in conmiyagi-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2e125bb096a79fe5c600e1826a5926312c29943a9f33edb1f2efbb0e0416203 The package conmiyagi-map was found to contain malicious code. Source: ghsa-malware fc52bddaac2d657d1e598f3b111f1195c1841882824da63324fac949f6f341ab...

[SECURITY] Fedora 42 Update: python-pdfminer-20240706-5.fc42

Pdfminer.six is a community maintained fork of the original PDFMiner. It is a tool for extracting information from PDF documents. It focuses on getting and analyzing text data. Pdfminer.six extracts the text from a page directly from the sourcecode of the PDF. It can also be used to get the exact...

Operational Runtime Behavior Mining for Open-Source Supply Chain Security

Open-source software OSS is a critical component of modern software systems, yet supply chain security remains challenging in practice due to unavailable or obfuscated source code. Consequently, security teams often rely on runtime observations collected from sandboxed executions to investigate...

Malicious code in mui7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 229ec4207198813ec81b334b0a5ac72c964258b80165cda21a1c25564819ad83 The package mui7 was found to contain malicious code. Source: ghsa-malware 81251ad548d890c9ade683aab8ffd6fb9d307a5e8bf6359d3b31f91080d26e8e Any...

MAL-2026-196 Malicious code in oe-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53c7a0c82b0a316878dbbd5767381ca0ef874192a308eb5001b953915dc816b The package oe-oauth was found to contain malicious code. Source: ghsa-malware 412d8ae25ded16fb507e7d120484a172ece322758c56fb4da2a6a7cd79b5be49 Any...

MAL-2026-195 Malicious code in mui7icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a78d5005068e75f9e5cc23616c1aa5a52bded7585e24cac270cdc0623c54de8 The package mui7icons was found to contain malicious code. Source: ghsa-malware bb725c3a171c7afa85beb301d5067750d7d43a1cd8f3dc836c4296dda3cd283b Any...

Malicious code in vet-bones (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3ce97e3af4cf9c82b0a51f4b693273ac59c6b1357b445b5613fbdcf7edec9a9 The package vet-bones was found to contain malicious code. Source: ghsa-malware 963e426141db06e18a04d497aed8ab05c8c6acfc76e6570d7c4a0bd2d81d7658 Any...

MAL-2026-199 Malicious code in vet-bones (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3ce97e3af4cf9c82b0a51f4b693273ac59c6b1357b445b5613fbdcf7edec9a9 The package vet-bones was found to contain malicious code. Source: ghsa-malware 963e426141db06e18a04d497aed8ab05c8c6acfc76e6570d7c4a0bd2d81d7658 Any...

MAL-2026-197 Malicious code in resto_ui_components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd3404a7cf3642d3e49538ae488a44a564dc5dd94102302ab33814b62e4427a The package restouicomponents was found to contain malicious code. Source: ghsa-malware...

MAL-2026-188 Malicious code in shopping-cart-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35497d79077eb5f8f79659d420f79568f9fcf905b9ab2f2cceb043eb6eba574 The package shopping-cart-service was found to contain malicious code. Source: ghsa-malware...

CVE-2026-22609 Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafeimports method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected...

EUVD-2026-1685

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafeimports method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected...

CVE-2026-22609 Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, the unsafeimports method in Fickling's static analyzer fails to flag several high-risk Python modules that can be used for arbitrary code execution. Malicious pickles importing these modules will not be detected...

Behavioral Analytics for Continuous Insider Threat Detection in Zero-Trust Architectures

Insider threats are a particularly tricky cybersecurity issue, especially in zero-trust architectures ZTA where implicit trust is removed. Although the rule of thumb is never trust, always verify, attackers can still use legitimate credentials and impersonate the standard user activity. In...

QES-Backed Virtual FIDO2 Authenticators: Architectural Options for Secure, Synchronizable WebAuthn Credentials

FIDO2 and the WebAuthn standard offer phishing-resistant, public-key based authentication but traditionally rely on device-bound cryptographic keys that are not naturally portable across user devices. Recent passkey deployments address this limitation by enabling multi-device credentials...

ZkRansomware: Proof-Of-Data Recoverability and Multi-Round Game Theoretic Modeling of Ransomware Decisions

Ransomware is still one of the most serious cybersecurity threats. Victims often pay but fail to regain access to their data, while also facing the danger of losing data privacy. These uncertainties heavily shape the attacker-victim dynamics in decision-making. In this paper, we introduce and...

Fickling vulnerable to detection bypass due to "builtins" blindness

Fickling's assessment Fickling started emitting AST nodes for builtins imports in order to match them during analysis https://github.com/trailofbits/fickling/commit/9f309ab834797f280cb5143a2f6f987579fa7cdf. Original report Summary Fickling works by Pickle bytecode -- AST -- Security analysis...

GHSA-H4RM-MM56-XF63 Fickling vulnerable to detection bypass due to "builtins" blindness

Fickling's assessment Fickling started emitting AST nodes for builtins imports in order to match them during analysis https://github.com/trailofbits/fickling/commit/9f309ab834797f280cb5143a2f6f987579fa7cdf. Original report Summary Fickling works by Pickle bytecode -- AST -- Security analysis...

Fickling has a bypass via runpy.run_path() and runpy.run_module()

Fickling's assessment runpy was added to the list of unsafe imports https://github.com/trailofbits/fickling/commit/9a2b3f89bd0598b528d62c10a64c1986fcb09f66. Original report Summary Fickling versions up to and including 0.1.6 do not treat Python’s runpy module as unsafe. Because of this, a malicio...