CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

CVE-2026-85651 Trigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

Malicious code in real-router-telemetry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78bc9af22f0b3feafc2dbd863d7ce4b9ba26418ab58e87bc231123004a40a450 Package ships telemetry.js, an obfuscated module string-array accessor pattern hiding identifiers and the destination that reads host identity...

Malicious code in line-through (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname...

MAL-2026-15923 Malicious code in line-through (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f080fb3d5e59c5c950dd4dd0c2eb1841cdc2943e1543bd7803f7ca27d1756e60 The package's package.json preinstall hook runs vishu.js, which at npm install time collects the installer's public IP via api.ipify.org, OS hostname...

CVE-2026-85651: Missing Authorization

Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs into arbitrary environments. Attackers can replay their own runs into other organizations' or projects' environments to consume victim...

PT-2026-85552

Name of the Vulnerable Software and Affected Versions Trigger.dev versions prior to 4.5.2 Description Authenticated attackers can inject task runs into arbitrary environments because the software fails to validate environment membership during run replay operations. This allows attackers to repla...

gitpython: GitPython: Information disclosure via environment variable expansion in URL handling

A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted...

EUVD-2026-62607

Orval: RCE via schema property name - computed-property-key injection in the MSW mock generator...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the JSON parsing process. An attacker can cause the application to terminate unexpectedly by supplying a specially crafted large JSON input, leading to memory corruption and potential denial of service...

MAL-2026-15861 Malicious code in py-1requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6d1a5c78d4368dc76a90cc90a68e4264170ed9ef208c8096251798734bb0d6 py1requests is a typosquat of the popular requests library leading 1 inserted inside the name. On import, py1requests/init.py iterates os.environ and...

Malicious code in py-2equests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bd7b93cf88d0fbcca30c50d9c9de6e14134cd2890be5a7a785e9330e98a988c py-2equests is a typosquat of the popular 'requests' package substituting '2' for 'r'. On import py2equests, the top-level module body iterates...

MAL-2026-15860 Malicious code in py-0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1f4c6176eadca0e4a460d4434e9957eb9befa90d85feecd49e4baf7f3abb4b py-0requests is a homoglyph typosquat of the PyPI package requests letter o replaced with digit 0. On import py0requests, top-level code in the...

Malicious code in py-0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1f4c6176eadca0e4a460d4434e9957eb9befa90d85feecd49e4baf7f3abb4b py-0requests is a homoglyph typosquat of the PyPI package requests letter o replaced with digit 0. On import py0requests, top-level code in the...

Malicious code in 0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78 The package name '0requests' is a one-character variant of the popular PyPI package 'requests'. On import of the top-level package, init.py enumerate...

Malicious code in @quantixfinance/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...

MAL-2026-15850 Malicious code in @quantixfinance/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...

Malicious code in @quantixfinance/tron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf106f622a8d60232e7d296737eab7e44ffc42a598f40b4b2afea24aaa15f7c The package's declared preinstall script iterates process.env, filters keys against a broad credential/secret keyword list key, secret, token, pass,...

Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...

MAL-2026-15849 Malicious code in @quantixfinance/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...