0xkobold (>=0.0.1, <=0.8.0), @0xwork/connect (>=0.1.0, <=0.1.7) +555 more potentially affected by CVE-2026-54327 via @mariozechner/pi-coding-agent (>=0.28.0, <=0.73.1)

@mariozechner/pi-coding-agent NPM version =0.28.0, =0.0.1, =0.1.0, =1.0.0-alpha, =0.1.8-fix.3, =0.0.183-staging.22859086, =5.0.0, =0.1.6-staging.22859086, =0.1.1-staging.04cc300a, =4.0.153, =0.1.1-staging.04cc300a, =0.1.0, =0.1.1-staging.29187771, =0.1.1-staging.0dc03363, =0.0.2-staging.29187771,...

@0xwork/connect (0.1.8), @a5c-ai/agent-platform (>=5.0.1-staging.016f0b0e8119, <=5.0.1-staging.ffad3b46492e) +259 more potentially affected by CVE-2026-54327 via @earendil-works/pi-coding-agent (>=0.74.0, <=0.78.0)

@earendil-works/pi-coding-agent NPM version =0.74.0, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.078c111a306a, =5.1.1-staging.00ceebd28cf2, =5.1.1-staging.00ceebd28cf2, =5.0.1-staging.016f0b0e8119, =5.0.1-staging.3abdf9534c25, =0.6.4, =0.3.1, =0.4.7, =2026.5.12-zh,...

Malicious code in redis-type-xyz (npm)

The redis-type-xyz package is an empty impersonation of Redis OM. It copies the redis-om-node repository, homepage, author, documentation, and declared dist/index.js entry point, but the published archive does not contain the declared dist directory or any usable implementation. Its dependency li...

@mseep/easy-notion-mcp (1.0.1), ioredis-xyz (5.11.2) potentially affected by unknown CVE via redis-type-xyz (1.10.6)

redis-type-xyz NPM version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on redis-type-xyz and may be impacted: - @mseep/easy-notion-mcp 1.0.1 - ioredis-xyz 5.11.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-11205...

MAL-2026-11205 Malicious code in redis-type-xyz (npm)

The redis-type-xyz package is an empty impersonation of Redis OM. It copies the redis-om-node repository, homepage, author, documentation, and declared dist/index.js entry point, but the published archive does not contain the declared dist directory or any usable implementation. Its dependency li...

Security Bulletin: IBM Engineering Lifecycle Management on Hybrid Cloud multiple vulnerabilities addressed

Summary This release addresses security vulnerabilities in application and operator images of ELM on Hybrid cloud offering. Identified vulnerabilities identified below relate to the underlying OS packages and language dependencies which impacts the product within the deployed environment. Two of...

MAL-2026-5985 Malicious code in node-path-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180db640dc8207694eb4629834f74b740d7efc9febf26067d190e10656fe04e9 Package name node-path-utils and its README/description claim it is 'an exact copy of the NodeJS path module', impersonating the Node.js core path...

Malicious code in node-path-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180db640dc8207694eb4629834f74b740d7efc9febf26067d190e10656fe04e9 Package name node-path-utils and its README/description claim it is 'an exact copy of the NodeJS path module', impersonating the Node.js core path...

MAL-2026-5976 Malicious code in cryptodao-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44bcbcde72a12ed60b3d16200226faa40f1e7e66c6ac36776710f2a0a3fec9a7 package.json declares a postinstall hook that runs recon.js on every npm install. recon.js harvests installer-side secrets — AWSSECRETACCESSKEY,...

MAL-2026-5974 Malicious code in cryptodao-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecefbb2ee777ab552f12fef0eab9af65f0a6c79f8a75a90f3df495a6746ec4a On npm install, the package's postinstall hook executes recon.js, which harvests installer-side data and POSTs it to attacker-controlled endpoints...

MAL-2026-5978 Malicious code in cryptodao-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e08a5a6fa93f0080d53371f566846f4258ed5e50479f43b9fc10c7a9716410 package.json declares postinstall: node recon.js, which runs automatically on every npm install. recon.js harvests host information and a curated lis...

MAL-2026-5977 Malicious code in cryptodao-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce8426b1d9dc5bde6547b58a21f2d3b519e56f7c2f948aa7e2173261532cee7 On npm install, the package's postinstall hook executes recon.js, which enumerates a hardcoded list of credential-bearing environment variables...

Malicious code in @public-for-cdao/abi (npm)

The @public-for-cdao/abi package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10599 Malicious code in @public-for-cdao/abi (npm)

The @public-for-cdao/abi package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10600 Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10603 Malicious code in @public-for-cdao/token (npm)

The @public-for-cdao/token package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10601 Malicious code in @public-for-cdao/common (npm)

The @public-for-cdao/common package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10602 Malicious code in @public-for-cdao/config (npm)

The @public-for-cdao/config package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...