1272 matches found
MAL-2026-2102 Malicious code in storefront-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f98f783cc760be758abd241914b7bb745e69248c87c20f1b84d14a522676413a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the /appearance/filepath file-serving handler in kernel/server/serve.go. An attacker can read arbitrary files accessible to the server process by requesting crafted ../ paths. Notes -...
Malicious code in svg-content-validation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9ab01c7680d2b5bb6bfb2ff3c6f36e38f3a5f604096e8e9c8c7cba22622cae1 The package svg-content-validation was found to contain malicious code. Source: ghsa-malware...
Malicious code in cryptopapi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8115fdc278d0fa50691d9381670d65784c4e58c7350c6f039f4cc48900003832 The package cryptopapi was found to contain malicious code. Source: ghsa-malware 36add754a3a299e4d93abe760b631b4a294d017297d11825b1fc1e2363030172 Any...
MAL-2026-1953 Malicious code in kyxhiagent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 985abb24ef3818e6c2ef2e790091b87b25294c5bebf9178c19c7d4b795b022bd The package kyxhiagent was found to contain malicious code. Source: ghsa-malware ef1853d56bb18df4db70df3663e706c9b0e1eff4c8bf9351147e156d1b7ed8b3 Any...
MAL-2026-1969 Malicious code in spstargm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ce1a8a7d00ca1aef6f9b8efb51402365637ca06d3d60ac779221ed3c0827d9 The package spstargm was found to contain malicious code. Source: ghsa-malware a0415f3c475983a53adb25756b7fd123d025c7be9670499938f81de0229f596e Any...
Malicious code in pretty-ts-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3252c2860c3dca66dbc03f90407ce4f37b310c8e4f6bfc6485625b1b7d926cd2 The package pretty-ts-logger was found to contain malicious code. Source: ghsa-malware 0c811c327f0147313f0f5362e62e94d0aadf15ac53937bb3e88b133748db9c...
External Control of File Name or Path
Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the importSY, importZipMd, importSyncProviderWebDAV, importSyncProviderS3, and importConf file import processes in the kernel/api/import.go, kernel/api/sync.go, and kernel/api/system.go...
MAL-2026-1449 Malicious code in vtimmmmmm-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f98c647bcb6a277d8ef94407b1287e79a9840e0956aa955ff01ea19778219c7 The package vtimmmmmm-test was found to contain malicious code. Source: ghsa-malware 7f04d92a8262ba75c225fb58633a5dfbe7c1d4a750b88f634dde448a81e13b63...
Malicious code in up2-daemon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc22b1546303513e047c5c729ec0f40a5880bf1dd5981592933c689f4cbf3e6 The package up2-daemon was found to contain malicious code. Source: ghsa-malware 4b6e1244d13ef29a84a4b55701182d9aacbd9feb8c6979534eb0493c28ab6e9a Any...
MAL-2026-1533 Malicious code in todo-plz (npm)
The package 'todo-plz' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.com...
MAL-2026-1503 Malicious code in minify-replace (npm)
The package 'minify-replace' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server npm.jpartifacts.co...
Malicious code in transform-undefined-to-void (npm)
The package 'transform-undefined-to-void' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
MAL-2026-1392 Malicious code in @dinzid04/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c73bb6dd5e6b3ba149f8a95cc91deaa505ee81bbdc34eca6e16bd7d2cc1a2f The package @dinzid04/libsignal-node was found to contain malicious code. Source: ghsa-malware...
MAL-2026-1372 Malicious code in @sky-it-livedata-libraries/livedata-commons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20bdbc3cff45e6eac27e84e332d4efa6ad06a4d593b15610a99115bac25d2931 The package @sky-it-livedata-libraries/livedata-commons was found to contain malicious code. Source: ghsa-malware...
Malicious code in @kinggupong/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3aec3e6bd7152f810947ba89be8ccb87de340b49801eef6c91c2a809330dfb03 The package @kinggupong/baileys was found to contain malicious code. Source: ghsa-malware...
EUVD-2026-11170
External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access...
CVE-2026-30903
External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access...
Malicious code in gamma-api-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0c08011b9300cb8b734d3d0bebc12d47ba78173fd7bb3b676459217b0c2d367 The package gamma-api-provider was found to contain malicious code. Source: ghsa-malware...