MAL-2026-17264 Malicious code in @hrmony/kit-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a4084c44ab6554d66c474338de2cb482a25b31e6822d470e08b2b2ef5b1735a The package executes credential-harvesting code both from its postinstall script scripts/check-setup.mjs and from its main entry index.js, so theft...

Malicious code in @hrmony/cdk-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...

MAL-2026-17258 Malicious code in @hrmony/cdk-constructs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6601c44353f60d117ef4e1ea09f9d2c997cde4375af70c49c628b38db8f1b55a On require/import, index.js executes top-level async code that harvests AWS EC2 instance metadata via IMDSv2 including IAM role security credentials...

MAL-2026-17256 Malicious code in @hrmony/benefit-sachbezug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de40a55476bbcc5eda275f9f385396699f1b066bf1ddedb80fad053c4057c63a The package's main entry index.js executes at require/import time and POSTs harvested data to the hardcoded endpoint...

Malicious code in @hrmony/pladddform-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607004ff93f1fcd5fbf7b1cf6b5e104b7f26eb699aee3dd4f8bbb33494f0b096 On module import, index.js executes an unconditional exfiltration payload against the installer/runtime host. It queries the AWS EC2 Instance Metadat...

MAL-2026-17252 Malicious code in @hrmony/belegerfassung-pladddform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615255a66c44204b03e60a165c1a9b21f95ecd351bf58c355462c159c74d1017 The package's main module index.js executes exfiltration logic at top level on import. It first sends a hello beacon via HTTP POST to the hardcoded...

Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...

MAL-2026-17261 Malicious code in @hrmony/gutscheinverwaltung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05705e4815a7ce926aad55136e379d3f901ad923a0fcb7f4002cf16e6cd78c56 On module load, the package performs top-level fetches against the AWS EC2 Instance Metadata Service using IMDSv2 requesting a token, then reading...

CVE-2026-61681 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

CVE-2026-61681: Server-Side Request Forgery (SSRF)

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, the SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go calls http.Get on payload.UnsubscribeURL after VerifyPayload even though BuildSignature...

EUVD-2021-26414

Malware in sbrugna...

Hackers Exploit Pandoc CVE-2025-51591 to Target AWS IMDS and Steal EC2 IAM Credentials

Cloud security company Wiz has revealed that it uncovered in-the-wild exploitation of a security flaw in a Linux utility called Pandoc as part of attacks designed to infiltrate Amazon Web Services AWS Instance Metadata Service IMDS. The vulnerability in question is CVE-2025-51591 CVSS score: 6.5,...

CVE-2021-3062: Improper Access Control

An improper access control vulnerability in PAN-OS software enables an attacker with authenticated access to GlobalProtect portals and gateways to connect to the EC2 instance metadata endpoint for VM-Series firewalls hosted on Amazon AWS. Exploitation of this vulnerability enables an attacker to...

PT-2021-4800

Name of the Vulnerable Software and Affected Versions PAN-OS versions 8.1 through 8.1.19 PAN-OS versions 9.0 through 9.0.13 PAN-OS versions 9.1 through 9.1.10 PAN-OS versions 10.0 through 10.0.7 Description An improper access control issue in PAN-OS software allows an attacker with authenticated...