Malicious code in compact-beige-crocodile (npm)

Source: amazon-inspector aaa24721be18045cb4cc85b77da967c9bb9dd61da50916f83bcc7610ea5a69ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in compact-green-silkworm (npm)

Source: amazon-inspector 37c715dcbad1e86b4bbd8fb7263722919b92e8fea2085f1565b84b2789190e47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in compact-indigo-alpaca (npm)

Source: amazon-inspector 50769b8e4194fae74ccb6edfe5d0faff22c235bb3c9a9173e5f5073eecd3517b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in alb-um-availa-ble-zip-mp3-file-234851-compact-guide-to-pop-music-space-travel-w7z48-vlfxwu (npm)

The package alb-um-availa-ble-zip-mp3-file-234851-compact-guide-to-pop-music-space-travel-w7z48-vlfxwu was found to contain malicious code. --- Credit: OpenSSF source...

Malicious Package

Overview bcs-compact is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

MAL-2026-13925 Malicious code in bcs-compact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b93f1a0694dc37c94e18c12eb32ebe9cab96ded318e46ee5c774db80f4a648 On require'bcs-compact', index.js runs a self-scrubbing IIFE that reads the installer's Sui wallet keystore at /.sui/sui.keystore,...

Malware in bcs-compact

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in bcs-compact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b93f1a0694dc37c94e18c12eb32ebe9cab96ded318e46ee5c774db80f4a648 On require'bcs-compact', index.js runs a self-scrubbing IIFE that reads the installer's Sui wallet keystore at /.sui/sui.keystore,...

Antares: Foundation Models for Agentic Vulnerability Localization

Vulnerability localization is a fundamental step in software security, requiring models to reason over large codebases and iteratively identify vulnerable implementations. We present Antares, a family of compact language models 350M, 1B, and 3B parameters for agentic vulnerability localization...

Auerswald COMpact 5500R 7.8A and 8.0B Devices Backdoor Detection

Auerswald COMpact 5500R 7.8A and 8.0B devices contain an unauthenticated endpoint "https://192.168.1.2/aboutstate", enabling the bad actor to gain backdoor access to a web interface that allows for resetting the administrator password. !/usr/bin/env python3 -- coding: utf-8 -- """Auerswald COMpac...

SolarView Compact 6.00 - Cross-Site Scripting Detection

SolarView Compact 6.00 contains a cross-site scripting vulnerability via fname at /SolarImage.php. !/usr/bin/env python3 -- coding: utf-8 -- """SolarView Compact 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

SolarView Compact 6.00 - Local File Inclusion Detection

SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files. !/usr/bin/env python3 -- coding: utf-8 -- """SolarView Compact 6.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

SolarView Compact 6.00 - Cross-Site Scripting Detection

SolarView Compact 6.00 contains a cross-site scripting vulnerability via SolarAiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

SolarView Compact Panel - Detect

SolarView Compact panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SolarView Compact panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SolarView Compact Panel - Detect', 'description...

SolarView Compact 6.00 - 'time_begin' Cross-Site Scripting Detection

SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'timebegin' parameter to SolarHistory.php. !/usr/bin/env python3 -- coding: utf-8 -- """SolarView Compact version 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

SolarView Compact 6.00 - 'pow' Cross-Site Scripting Detection

SolarView Compact version 6.00 contains a cross-site scripting vulnerability in the 'pow' parameter to SolarSlideSub.php. !/usr/bin/env python3 -- coding: utf-8 -- """SolarView Compact version 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

SolarView Compact <= 6.00 - Local File Inclusion Detection

There is an arbitrary read file vulnerability in SolarView Compact 6.00 and below, attackers can bypass authentication to read files through texteditor.php !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary read file vulnerability in SolarView Compact 6.""" from kittysploit import...

SolarView Compact < 6.00 - Directory Traversal Detection

SolarView Compact before version 6.00 is vulnerable to directory traversal via the file parameter in downloader.php. An unauthenticated attacker can read arbitrary files from the system by using path traversal sequences with a null byte bypass to access sensitive files such as /etc/passwd...

Allocation of Resources Without Limits or Throttling

Overview org.apache.thrift:libthrift is a lightweight, language-independent software stack with an associated code generation mechanism for point-to-point RPC. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the TCompactProtocol...

CVE-2026-14985 CVE-2026-14985

The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation vulnerability in the core firmware. This is due to improper privilege delegation and insufficient input validation in a maintenance script...