GHSA-XMPW-2VMM-P4P6 Malicious code in guardrails-ai 0.10.1 (supply chain compromise)

Impact On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of guardrails-ai 0.10.1 to PyPI. Affected: any user who installed guardrails-ai==0.10.1 from PyPI on May 11, 2026. Security researchers identified the malicious package within approximately 2 hours ...

CVE-2026-47671

creationtimestamp| type| source ---|---|--- 2026-05-19 11:17:06+00:00| published-proof-of-concept| https://github.com/nhost/nhost/security/advisories/GHSA-64cj-qvx5-m4f3...

CVE-2026-47423

creationtimestamp| type| source ---|---|--- 2026-05-19 09:26:54+00:00| published-proof-of-concept| https://github.com/cure53/DOMPurify/security/advisories/GHSA-87xg-pxx2-7hvx 2026-06-04 11:02:16+00:00| seen| https://t.me/GithubRedTeam/87264 2026-07-22 12:07:06+00:00| seen|...

CVE-2026-47429

creationtimestamp| type| source ---|---|--- 2026-05-19 09:24:23+00:00| published-proof-of-concept| https://github.com/vitest-dev/vitest/security/advisories/GHSA-5xrq-8626-4rwp 2026-06-07 23:20:25+00:00| seen| https://bsky.app/profile/securitylab-jp.bsky.social/post/3mnqcloetts2r 2026-06-09...

CVE-2026-47428

creationtimestamp| type| source ---|---|--- 2026-05-19 09:23:47+00:00| published-proof-of-concept| https://github.com/vitest-dev/vitest/security/advisories/GHSA-2h32-95rg-cppp 2026-07-15 13:38:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqotrh5lhp2u 2026-08-20...

Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer

Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code VS Code Marketplace. The extension in question is rwl.angular-console version 18.95.0, a popular user interface and plugin for code editors like VS Code,...

CVE-2026-47399

creationtimestamp| type| source ---|---|--- 2026-05-19 06:35:47+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-6h6v-6m7w-7vxx 2026-07-21 18:33:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6h3ybzeo23...

CVE-2026-47391

creationtimestamp| type| source ---|---|--- 2026-05-19 06:35:04+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-vg22-4gmj-prxw 2026-06-15 17:02:34+00:00| seen| MISP/d511a704-eba2-411a-9543-41e0e130f522 2026-07-21 16:44:06+00:00| seen|...

CVE-2026-47398

creationtimestamp| type| source ---|---|--- 2026-05-19 06:35:03+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-78r8-wwqv-r299 2026-07-21 18:47:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6huto2mm2b...

CVE-2026-47397

creationtimestamp| type| source ---|---|--- 2026-05-19 06:35:00+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-hvhp-v2gc-268q 2026-07-21 18:29:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6guka6je2e...

CVE-2026-47396

creationtimestamp| type| source ---|---|--- 2026-05-19 06:34:59+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-86qc-r5v2-v6x6 2026-07-21 16:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6axknrdb2a...

CVE-2026-47394

creationtimestamp| type| source ---|---|--- 2026-05-19 06:34:57+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-9cr9-25q5-8prj...

CVE-2026-47392

creationtimestamp| type| source ---|---|--- 2026-05-19 06:34:53+00:00| published-proof-of-concept| https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-4mr5-g6f9-cfrh 2026-07-21 16:26:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr67xexkxl2i...

CVE-2026-46681

creationtimestamp| type| source ---|---|--- 2026-05-19 06:24:42+00:00| published-proof-of-concept| https://github.com/nevware21/ts-utils/security/advisories/GHSA-x7j8-49r8-mr43...

Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials

In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper , to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server. "Every existing tag in the repository has...

Malicious code in @antv/gi-cli (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in jest-canvas-mock (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/l7-utils (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in relationship.js (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/f6-hammerjs (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...