MAL-2026-10588 Malicious code in momenntjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aae445dd0b77bd7409820067097404e4ccb16d658e7911c7c4e659146fdfad4 momenntjs is a typosquat of momentjs whose package.json postinstall hook runs node.init.js. On npm install,.init.js enumerates roughly 60...

MAL-2026-10594 Malicious code in yargsplus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ae65e1d6362744681f51216b451ba9889176b3b0c28b1b4c943f1b5033fdd4 The package declares a postinstall hook node.init.js that runs automatically on npm install. The script enumerates roughly 60 credential and CI...

MAL-2026-10585 Malicious code in cheeriobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1160a4c1ee0340e9897a42a75d735750b7d92fc887bef135a5a979c371356df4 [email protected] is a delivery vehicle for install-time credential theft. package.json declares a postinstall hook that runs node.init.js, which...

MAL-2026-10593 Malicious code in twiliobox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a94eb66c6d3f03cf5b4e2e13527b9ab9bcb1ae85e75b62f79f58e225b941970 On npm install, [email protected] runs its declared postinstall script node.init.js, which enumerates credential-shaped environment variables NPMTOKEN,...

MAL-2026-10590 Malicious code in openaiwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...

MAL-2026-10592 Malicious code in stripedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b1bd48eb1fe3b563d9950f59df7fcfe699d0f1b51820c47b721f59ee74af34 package.json declares postinstall: node.init.js, which runs automatically on npm install. The script enumerates 60 credential and CI-token environmen...

MAL-2026-10575 Malicious code in web-pop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40594f220414cf22d0879782f17f921f8c6fd17d054b70dd1a0c2b3851c0080a web-pop is a typosquat of pino copied description and keywords. On module load, lib/initializeCaller.js runs a top-level IIFE that reconstructs a...

MAL-2026-10549 Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

MAL-2026-10547 Malicious code in pokee-data-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b6677ea5f73a9b1fbbc0dc209ef6b5d31077f316df63eec1ba4054f60645431 The package performs credential and environment harvesting at both install time and import time. setup.py installs a PostInstall cmdclass that, durin...

Exploit for OS Command Injection in Gnu Bash

CVE-2014-6271 - Shellshock PoC Summary CVSS 10.0. Bash imp...

MAL-2026-10543 Malicious code in skrill-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e517423e768b0086d0579e460801e0b14cb6e6751a810b23bd9f41954d92779 Package impersonates a Paysafe/Skrill payments SDK name 'skrill-payments', class PaysafeClient, spoofed 'github.com/paysafe/skrill-payments' reposito...

MAL-2026-10538 Malicious code in neteller (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 167278e6d334ec3629d24f3031e8dd2920ebbbdfd9ea4918cde2fd1d60e41c3c Package name and description impersonate the Paysafe-owned Neteller payment brand, with a fake repository URL 'github.com/paysafe/neteller'. The...

MAL-2026-10544 Malicious code in skrill-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61b89b04fbb6a34ea37a855c5ee938aa6c4f91cc2e79d9880d14436a09b2e8a5 Package publishes as skrill-sdk and exposes a PaysafeClient API payments.create/get, customers.create/get that mimics an official Skrill/Paysafe...

Malicious code in motion-pull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e50d15810c044b3b0355460fdeacea42d89944d351e74bcce9fd976f91915ea [email protected] impersonates the pino logger exports module.exports.pino = middleware, uses logger-themed keywords, ships a ./pino require target...

MAL-2026-10519 Malicious code in chai-as-sets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4 The package name and description advertise a chai plugin, but the main entry point spawns a detached child process lib/initializeCaller.js when the...

MAL-2026-10518 Malicious code in chai-as-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12dffbf180eff9ea18e21c9fc8c514912e95e40b3439fc43c3e3124b7ed189a3 lib/initializeCaller.js contains a self-executing IIFE that POSTs the entire process.env object to a hardcoded remote endpoint and then executes the...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via improper filtering of environment variables in the host exec process. An attacker can gain unauthorized access or perform actions beyond their...

Incomplete List of Disallowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the host exec environment filtering process. An attacker can gain unauthorized access and execute or persist actions beyond their intended...

EUVD-2026-43539

OpenClaw versions before 2026.6.6 contain a flaw in host exec environment filtering that can miss interpreter startup variables. When the affected feature is enabled and reachable, a lower-trust caller or configured input path can supply crafted environment variables to execute or persist actions...

PT-2026-60091

Name of the Vulnerable Software and Affected Versions Kimai versions prior to 2.58.0 Description The official Docker image includes a default environment variable APP SECRET set to a publicly known value. Because the Docker entrypoint does not validate or override this value, instances deployed...