Malicious code in carbon-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c617e93833344e13d376182fb00c13994a4d2e7f3f8220998e541d77a8e8713 The package's package.json declares a postinstall hook that runs index.js on npm install. index.js collects host reconnaissance and installer secrets...

CVE-2026-63640

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

NPM: MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

NPM: MagicMirror socket payload secret placeholder expansion can disclose SECRET environment variables vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

GHSA-Q4GH-4FFP-5CG8 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

Summary When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands SECRETNAME placeholders in every inbound socket payload before passing it to module helpers. Any client that can...

MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

Summary When hideConfigSecrets: true is enabled, MagicMirror redacts SECRET environment placeholders in the HTTP /config response, but the shared node-helper socket dispatcher expands SECRETNAME placeholders in every inbound socket payload before passing it to module helpers. Any client that can...

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

CVE-2026-63640

In MagicMirror² versions before 2.37.0, the catch-all socket dispatcher in js/node_helper.js runs replaceSecretPlaceholder on every inbound payload, letting an attacker submit a SECRET_API_KEY placeholder that expands to the live env value; the weather helper then echoes it back via WEATHER_ERROR...

CVE-2026-75915

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

CVE-2026-75915

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

CVE-2026-75915

CodeWhale versions before 0.8.64 fail to scrub parent process environment variables before spawning Node.js in the js_execution tool. Attackers executing malicious JavaScript via the tool can read process.env to exfiltrate API keys, cloud credentials, and auth tokens back to the model context. CV...

CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

CVE-2026-75915 CodeWhale before 0.8.64 Environment Variable Leak via js_execution

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the jsexecution tool that fails to scrub parent process environment variables before spawning Node.js. Attackers can craft malicious JavaScript code executed by the tool to read process.env and leak API key...

PT-2026-77166

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description The js execution tool fails to scrub parent process environment variables before spawning Node.js. This allows attackers to execute malicious JavaScript code that reads process.env to leak sensiti...

PT-2026-77235

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server functions.js before invoking...

libssh: libssh: information disclosure via ProxyCommand %r username expansion

A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior...

SUSE-SU-2026:23205-1 Security update for podman

This update for podman fixes the following issues: - CVE-2026-55686: Podman: WORKDIR symlink traversal vulnerability bsc1268579. - CVE-2026-57231: specially crafted image can trick podman run into leaking host environment variables into the container bsc1269471...

Insufficient Verification of Data Authenticity

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

PYSEC-2026-3766

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...

PYSEC-2026-3766

opensslencrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTESTCURRENTTEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticat...