Security update for azure-storage-azcopy

This update for azure-storage-azcopy fixes the following issues: Update to 10.32.6. Security issues fixed: CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266657. CVE-2026-56852:...

CVE-2026-9169

DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...

MAL-2026-13464 Malicious code in vite-svg-parse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6b581f4ab8d027c727649fae10749a9ac9a59af4619f5576362ab9243cb6c6 The package's exported API getPlugin/setPlugin decodes two base64 string literals at runtime: the first decodes to npm install node-internal-svg-load...

Malicious code in vite-svg-parse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f6b581f4ab8d027c727649fae10749a9ac9a59af4619f5576362ab9243cb6c6 The package's exported API getPlugin/setPlugin decodes two base64 string literals at runtime: the first decodes to npm install node-internal-svg-load...

MAL-2026-13435 Malicious code in @united-airlines-org/atmos-design-system (npm)

The package @united-airlines-org/atmos-design-system contains a malicious preinstall script in its package.json that runs automatically during installation. The script executes curl to send the machine's hostname, obtained via uname -n and base64-encoded, to the attacker-controlled endpoint...

GHSA-GWFQ-86J8-7QHV rclone: Verbose Stack Trace Disclosure in RC API Error Responses

Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...

MAL-2026-12669 Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...

Malicious code in jquery.ui.tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50fc48e6d03705244cf78a2f2ee23c6ffe5a91a64f98d23d6a31f94557bf0d84 [email protected] is a dependency-confusion squat: it is published at version 9999.0.0 with an empty runtime index.js contains only...

Malicious code in jquery.ui.core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe5bc94d3ac40b31064d4dad8125dc959fdc3559785cdbeb03de2cc16c147ac Package is a dependency-confusion squat on the jquery.ui.core name published at version 9999.0.0. The main entry index.js is empty module.exports = ;...

Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

Malicious code in @shiftmarkets/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bff275a2558640accb1a6956b933b71930ece1240bd8c5a0c2e00f74fc2fa82 The package declares a postinstall script node dist/recon.js that runs automatically on npm install. The script collects installer-side reconnaissanc...

Malicious code in electrode-ota-ui-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498 Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private...

MAL-2026-12368 Malicious code in electrode-ota-ui-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9fb0d73b7d26454a227e93754f11ff2405424b1279490863055e8d8c8c6498 Package targets the electrode-io internal name electrode-ota-ui-app with an inflated 99.0.1 version to win dependency resolution against a private...

Malicious code in matlab-azure-devops-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b The package's preinstall script node index.js auto-executes on npm install and collects host identifiers os.hostname, os.userInfo.username, home...

Malicious code in log-min (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc78815e8c40947273929a7224aa04230de911771e62580045fb8bb213468c9 The package publishes as 'log-min' with a description claiming it is a JavaScript library for the Theta Blockchain, while its README identifies the...

Malicious code in foodi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299310eb47eac6e7f39ee1a7346de8e524d9a91cc6a07d2e8879338fa86ff5af package.json declares preinstall and postinstall lifecycle scripts that both execute curl -X POST -k -s...

Malicious code in tinkoff-pfpa-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29d523fe4960435cd996806856c38d2fde0c9862135d3a71a14322670f73d41 On require of tinkoff-pfpa-tools, index.js loads adapter.js which downloads a platform-specific native executable from Cloudflare Workers hosts whose...

MAL-2026-12251 Malicious code in tinkoff-pfpa-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29d523fe4960435cd996806856c38d2fde0c9862135d3a71a14322670f73d41 On require of tinkoff-pfpa-tools, index.js loads adapter.js which downloads a platform-specific native executable from Cloudflare Workers hosts whose...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...