Malicious code in @alphaspace/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507 preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at...

MAL-2026-17180 Malicious code in my-private-pkg (PyPI)

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches myprivatepkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POS...

Malicious code in my-private-pkg (PyPI)

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches myprivatepkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POS...

PT-2026-99007

Parse Server before 4.10.0 was affected by a supply chain incident in which incorrect version tags were pushed to the official repository pointing to an unreviewed personal fork of a contributor with write access. No releases were published with these tags; a project was exposed only if it define...

SUSE CVE-2026-93269

In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4extmigrate Move iputtmpinode after ext4writepagesupwrite to avoid a circular lock dependency between swritepagesrwsem and sbinternal freeze protection. The deadlock scenario: CPU0...

argus-notification-msteams (0.5.1), argus-server (>=1.2.1, <=1.22.1) +78 more potentially affected by CVE-2026-57179 via social-auth-core (4.9.1)

social-auth-core PYPI version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argus-notification-msteams 0.5.1 - argus-server =1.2.1, =1.30.0, =1.234.0, =0.4.3, =0.8.7, =0.0.2a17, =0.1.0, =1.0.0, =2.2.0a0,...

umap-project (>=1.2.2, <=1.2.3) potentially affected by CVE-2026-57179 via social-auth-core (3.3.2)

social-auth-core PYPI version 3.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project =1.2.2, =1.2.3 Source cves: CVE-2026-57179 Source advisory: OSV:GHSA-VQG6-3FW6-J9JG...

masonite-socialite (>=0.0.1, <=0.0.5), richie (>=2.0.0b9, <=2.7.1) potentially affected by CVE-2026-57179 via social-auth-core (3.2.0)

social-auth-core PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - masonite-socialite =0.0.1, =2.0.0b9, =2.7.1 Source cves: CVE-2026-57179 Source advisory: OSV:GHSA-VQG6-3FW6-J9JG...

galaxy-data (>=20.9.1, <=21.9.0), umap-project (>=1.2.0, <=1.2.1) potentially affected by CVE-2026-57178 via social-auth-core (3.3.0)

social-auth-core PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-data =20.9.1, =1.2.0, =1.2.1 Source cves: CVE-2026-57178 Source advisory: OSV:GHSA-3C93-F73F-QC9H...

galaxy (>=25.1.0, <=25.1.2), galaxy-ng (>=4.8.0, <=4.9.2) +6 more potentially affected by CVE-2026-57177 via social-auth-core (4.7.0)

social-auth-core PYPI version 4.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy =25.1.0, =4.8.0, =0.9.0, =1.40.0, =1.111.0, =1.2.6, =4.16.3, =5.5.5 - weblate-fedora-messaging 0.6.0 Source cves:...

richie (>=2.8.0, <=2.12.0), weblate (>=4.9.0, <=4.10.1) potentially affected by CVE-2026-57177 via social-auth-core (4.1.0)

social-auth-core PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - richie =2.8.0, =4.9.0, =4.10.1 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-data (>=22.1.1, <=24.1.3) +13 more potentially affected by CVE-2026-57177 via social-auth-core (4.0.3)

social-auth-core PYPI version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - galaxy-app =23.0.1, =22.1.1, =23.0.1, =23.0.2, =21.9.0, =23.2.1, =0.4.0, =0.0.1, =0.13.0, =0.6.0, =0.1.0, =0.8.0, =0.1.0, =0.9.1...

masonite-socialite (>=0.0.1, <=0.0.5), richie (>=2.0.0b9, <=2.7.1) potentially affected by CVE-2026-57177 via social-auth-core (3.2.0)

social-auth-core PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - masonite-socialite =0.0.1, =2.0.0b9, =2.7.1 Source cves: CVE-2026-57177 Source advisory: OSV:GHSA-X7QQ-23VW-7PFG...

argus-notification-msteams (0.5.1), argus-server (>=1.2.1, <=1.22.1) +78 more potentially affected by CVE-2026-57176 via social-auth-core (4.9.1)

social-auth-core PYPI version 4.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - argus-notification-msteams 0.5.1 - argus-server =1.2.1, =1.30.0, =1.234.0, =0.4.3, =0.8.7, =0.0.2a17, =0.1.0, =1.0.0, =2.2.0a0,...

umap-project (3.1.0) potentially affected by CVE-2026-57175 via social-auth-core (4.6.1)

social-auth-core PYPI version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - umap-project 3.1.0 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

masonite-socialite (>=0.0.1, <=0.0.5), richie (>=2.0.0b9, <=2.7.1) potentially affected by CVE-2026-57175 via social-auth-core (3.2.0)

social-auth-core PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-core and may be impacted: - masonite-socialite =0.0.1, =2.0.0b9, =2.7.1 Source cves: CVE-2026-57175 Source advisory: OSV:GHSA-VQ6G-G6C7-5F2J...

@1sat/actions (>=0.0.173, <=0.0.190), @1sat/cli (>=0.0.75, <=0.0.90) +18 more potentially affected by CVE-2026-56744 via @bsv/wallet-toolbox (>=1.8.3, <=2.1.24)

@bsv/wallet-toolbox NPM version =1.8.3, =0.0.173, =0.0.75, =0.0.42, =0.0.34, =0.0.30, =0.0.3, =0.0.75, =0.0.56, =0.0.47, =0.0.25, =0.0.1, =0.1.0, =0.7.0, =0.2.0, =0.6.1 and more Source cves: CVE-2026-56744 Source advisory: GHSA-36F9-7RG5-CPF8...

@1sat/actions (>=0.0.173, <=0.0.190), @1sat/cli (>=0.0.75, <=0.0.90) +18 more potentially affected by CVE-2026-56744 via @bsv/wallet-toolbox (>=1.8.3, <=2.1.24)

@bsv/wallet-toolbox NPM version =1.8.3, =0.0.173, =0.0.75, =0.0.42, =0.0.34, =0.0.30, =0.0.3, =0.0.75, =0.0.56, =0.0.47, =0.0.25, =0.0.1, =0.1.0, =0.7.0, =0.2.0, =0.6.1 and more Source cves: CVE-2026-56744 Source advisory: OSV:GHSA-36F9-7RG5-CPF8...

2d6io-cryptobot (0.0.1), academic-metrics (>=0.1.0b0, <=1.0.99) +1409 more potentially affected by CVE-2026-96749 via pymongo (>=2.4.1, <=4.18.1)

pymongo PYPI version =2.4.1, =0.1.0b0, =1.0.4, =0.9.0, =0.4.2, =0.3.0, =3.6.0, =0.0.1.dev0, =0.1.0, =0.1.23, =1.1.5, =1.3.2 - ai-flow 0.3.1 and more Source cves: CVE-2026-96749 Source advisory: MEND:CVE-2026-96749...

com.azavea.geotrellis:geotrellis-server-stac-example_2.12 (4.4.0), com.azavea.geotrellis:geotrellis-stac-example_2.12 (4.3.0) +3 more potentially affected by CVE-2026-61741 via org.http4s:http4s-scala-xml_2.12 (>=0.18.0-m5, <=0.21.22)

org.http4s:http4s-scala-xml2.12 MAVEN version =0.18.0-m5, =0.1.3, =1.2.2, =0.1.0, =0.6.2 Source cves: CVE-2026-61741 Source advisory: MEND:CVE-2026-61741...