Astra Linux – Vulnerability in Chromium

The use of after free in GetUserMedia in Google Chrome before version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass the same-origin policy through a crafted HTML page. Chromium security severity: Low...

Astra Linux – Vulnerability in Chromium

The use of after-free in Core in Google Chrome before version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium security severity: Medium...

github.com/sigstore/sigstore-go: sigstore-go: Security Policy Bypass via Compromised Log

A flaw was found in sigstore-go, a Go library for Sigstore signing and verification. This vulnerability allows a single compromised transparency log or Certificate Transparency CT log to bypass the multi-log threshold requirements. An attacker could exploit this by compromising a single log,...

Malicious code in fs-extra-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397f5c6f4eb2cf734d5ee1afc9908bdd0162a91a2fc6ad6d7d51a5cfd22fdc41 Package impersonates fs-extra by copying its description, homepage github.com/jprichardson/node-fs-extra, and repository metadata verbatim. Its...

Malicious code in vitest-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e61d93e82877f836aaba3dd528e79f3e5f4b1bd12ce64b40202bbecd08a2747 Package published as vitest-axios re-ships axios source, README, homepage, and repository metadata to impersonate the legitimate axios HTTP client. I...

MAL-2026-11029 Malicious code in lychee-norm-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23ee684fa7edabc6e34aedc6e32e36c42fb68100a69908227e639d53592565de lychee-norm-cache is a dependency-confusion proof-of-concept that provides no functional utility. Its bin script POSTs a small JSON payload containin...

Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

MAL-2026-11024 Malicious code in create-kumo-project (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 172586ef83140a92d732376efb734e45aa09958a7800016aa3c229ccf74c81bf Package presents itself as a create--project scaffolder but ships no scaffolding functionality. The bin/run.js entry, invoked when a user runs npx...

Malicious code in da-sc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af0c0528114fb5ac6296c3390b435a78ce9dc9f0d90fc606a6cf5d05b3472f0 No a static rule matches and no behavioral findings were produced for this package version. With no evidence of exfiltration, install-time remote cod...

MAL-2026-11022 Malicious code in aio-commerce-lib-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9479591a21dd21e28dbd04aaf239e1da57eae40a248247d8e270d8e6f1278fdd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helix-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8efca4dde44b08de6562799d28d41e0793e171dc72cf0380bf8f8f330d9236d2 No a static rule matches and no behavioral findings of concern were identified for [email protected]. No install-time lifecycle scripts fetching...

Malicious code in bs58-88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6d1dec3ae934b73d28ddd4c002cf93f9a9be597731434f5cfead7fdbb11954f Package bs58-88 mimics the popular bs58 base58 encoder: README, keywords, and repository URL match the real bs58, and index.cjs re-exports...

PT-2026-64072

Summary When processing Pixeldrain URLs, cyberdrop-dl-patched could send an Authorization header that includes the user's API key to unverified hosts. Details Pixeldrain offers several alternative domains in case the user's ISP blocks the primary domain. To support this, requests made by...

PT-2026-64145

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false...

Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

MAL-2026-11012 Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

Malicious code in calvora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc3f7e9ef1bbc85d0303406eac1b28cace865d65ab2bbad1104ba2f0adaaa78 index.mjs auto-invokes a sync routine at module import. Under Linux with NODEENV!= production and access to a WSL /mnt/c mount, it locates a Windows...

MAL-2026-11010 Malicious code in calvora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc3f7e9ef1bbc85d0303406eac1b28cace865d65ab2bbad1104ba2f0adaaa78 index.mjs auto-invokes a sync routine at module import. Under Linux with NODEENV!= production and access to a WSL /mnt/c mount, it locates a Windows...