MAL-2026-17716 Malicious code in @brick-v2/form (npm)

@brick-v2/form is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

@galicia-toolkit-nestjs-20/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

MAL-2026-17715 Malicious code in @brick-v2/core (npm)

@brick-v2/core is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...

MAL-2026-17728 Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...

voice-agent-tequity (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-107717 via banks (2.2.0)

banks PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on banks and may be impacted: - voice-agent-tequity =0.1.0, =0.1.1 Source cves: CVE-2026-107717 Source advisory: GHSA-HMQ2-7HP6-7CRH...

cloud.piranha.session:piranha-session-hazelcast (20.12.0), com.bucket4j:bucket4j-hazelcast-4 (>=8.10.0, <=8.10.1) +43 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (4.1)

com.hazelcast:hazelcast MAVEN version 4.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - cloud.piranha.session:piranha-session-hazelcast 20.12.0 - com.bucket4j:bucket4j-hazelcast-4 =8.10.0, =8.11.0,...

com.corundumstudio.socketio:netty-socketio (2.0.14), com.erudika:para-cache-hazelcast (>=1.41.5, <=1.43.0) +221 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (5.6.0)

com.hazelcast:hazelcast MAVEN version 5.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.corundumstudio.socketio:netty-socketio 2.0.14 - com.erudika:para-cache-hazelcast =1.41.5, =1.8.0, =3.2.3,...

br.com.ingenieux:jbake-maven-plugin (>=0.0.3, <=0.0.9), com.darylteo:vertx-gradle-plugin (1.1.0-alpha1) +79 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (2.6)

com.hazelcast:hazelcast MAVEN version 2.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - br.com.ingenieux:jbake-maven-plugin =0.0.3, =1.0.0, =1.0.0-final, =1.0.0-final, =1.0.0-cr2, =1.0.0-cr2, =1.0.0-fina...

cn.vertxup:vertx-co (0.4.10), cn.vertxup:vertx-ifx (0.4.10) +49 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.12)

com.hazelcast:hazelcast MAVEN version 3.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - cn.vertxup:vertx-co 0.4.10 - cn.vertxup:vertx-ifx 0.4.10 - cn.vertxup:vertx-import 0.4.10 - cn.vertxup:vertx-pin...

com.bestellensoftware:jsync.io (1.8.6-alpha-2), com.hazelcast:hazelcast-build-utils (3.4.4) +9 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.4.4)

com.hazelcast:hazelcast MAVEN version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.bestellensoftware:jsync.io 1.8.6-alpha-2 - com.hazelcast:hazelcast-build-utils 3.4.4 -...

ch.mobi.mobitor:mobitor-base (>=3.1.305, <=3.1.313), cloud.piranha.extension:piranha-extension-hazelcast (21.10.0) +47 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (4.2.2)

com.hazelcast:hazelcast MAVEN version 4.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - ch.mobi.mobitor:mobitor-base =3.1.305, =1.37.0, =3.1.5, =0.5.0, =0.6.0, =0.9.0 and more Source cves:...

com.englishtown:vertx-mod-hk2 (>=1.0.0-beta1, <=1.0.0-beta5), com.englishtown:vertx-mod-jersey (>=1.0.0-beta1, <=1.0.0-beta5) +11 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (2.5.1)

com.hazelcast:hazelcast MAVEN version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.englishtown:vertx-mod-hk2 =1.0.0-beta1, =1.0.0-beta1, =2.0.0-beta1, =2.0.0-beta1, =1.0.0-beta1, =2.0.0-beta1,...

com.bucket4j:bucket4j-hazelcast-3 (>=7.6.1, <=8.9.0), com.bucket4j:bucket4j_jdk8-hazelcast-3 (>=8.0.0, <=8.9.0) +34 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (3.8)

com.hazelcast:hazelcast MAVEN version 3.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.bucket4j:bucket4j-hazelcast-3 =7.6.1, =8.0.0, =1.24.0, =0.9.0, =0.9.0, =0.3, =0.3, =0.3, =0.3, =0.3, =0.0.2,...

laravel-framework

About Laravel Note: This repository contains the core code of the Laravel framework. If you want to build an application using Laravel, visit the main Laravel repository. Laravel is a web application framework with expressive, elegant syntax. We believe development must be an enjoyable, creative...

cved

CVED Uno strumento per gestire container docker vulnerabili INSTALLAZIONE qt = 5.x docker git qmake make sudo make install UTILIZZO Crea il gruppo docker se non esiste già. sudo groupadd docker Aggiungi il tuo utente al gruppo docker. sudo usermod -aG docker $USER Esci e accedi di nuovo affinché ...

Malicious code in @dransay/secrets (npm)

Source: amazon-inspector aef0f6b36413e45664391c5341f7c30a4501c2cc916add9ba6525bf57e559d51 The package declares a preinstall script that runs beacon.js, which performs a DNS lookup and HTTPS GET to a hardcoded Interactsh collector host db3klhbi6i9hark1kegg174t38h33b6wt.oast.site at npm install tim...

Malicious code in @dransay/db (npm)

Source: amazon-inspector dc3d55a63787b5f45312d0b8433f6e782b2a6b28e89ef6377e24e5d26c757a61 On npm install, the package's preinstall hook executes beacon.js, which performs a DNS lookup and HTTPS GET to a hardcoded interactsh OAST subdomain under oast.site, embedding the package name in the path. T...

Malicious code in @dransay/logger (npm)

Source: amazon-inspector 5d4cbd17edce3b0c45619c9af869321807357e3dae1af8aa94835d3143185e85 The package @dransay/[email protected] ships a preinstall hook node beacon.js that fires on npm install. The script performs a DNS lookup and HTTPS GET to the interactsh collaborator host...

Malicious code in dransay (npm)

Source: amazon-inspector 46d06d0ce82913346840f676660d67f9838f48511e58eef793bfe7c52091071f [email protected] declares a preinstall lifecycle script that runs node beacon.js, which performs a DNS lookup and HTTPS GET against a hardcoded Interactsh oast.site collaborator subdomain...