CVE-2026-87858

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

Malicious code in test-mlw2-chasm-atopy-sidas-quake (npm)

The package test-mlw2-chasm-atopy-sidas-quake was found to contain malicious code...

Malicious code in test-mlw2-chasm-penks (npm)

The package test-mlw2-chasm-penks was found to contain malicious code...

MAL-2025-35060 Malicious code in test-mlw2-chasm-atopy-sidas-quake (npm)

The package test-mlw2-chasm-atopy-sidas-quake was found to contain malicious code...

MAL-2025-8571 Malicious code in @malware-test-corni-spill-babul-chasm/test-mlw3-corni-spill-babul-chasm (npm)

The package @malware-test-corni-spill-babul-chasm/test-mlw3-corni-spill-babul-chasm was found to contain malicious code...

MAL-2025-35061 Malicious code in test-mlw2-chasm-penks (npm)

The package test-mlw2-chasm-penks was found to contain malicious code...