Malicious code in carvus-lens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be2182b552b0a8359f3314078d48310cfcd57738e1934aacf00ac8775a32cfe0 carvus-lens is a screen-capture/OCR Electron-style tool whose advertised 'Ask AI', 'Translate', and 'Search' features silently route user-selected...

MAL-2026-4505 Malicious code in carvus-lens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be2182b552b0a8359f3314078d48310cfcd57738e1934aacf00ac8775a32cfe0 carvus-lens is a screen-capture/OCR Electron-style tool whose advertised 'Ask AI', 'Translate', and 'Search' features silently route user-selected...

Malicious code in eplang (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d53e4571f8ccfc385a265dfd47cbea9793946762a794aff432e98614ee10b21 The package ships epl/.aiconfig.json containing a hardcoded Groq API key with provider set to 'groq'. On any AI-related CLI invocation epl ai, epl ge...

MAL-2026-4748 Malicious code in eplang (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d53e4571f8ccfc385a265dfd47cbea9793946762a794aff432e98614ee10b21 The package ships epl/.aiconfig.json containing a hardcoded Groq API key with provider set to 'groq'. On any AI-related CLI invocation epl ai, epl ge...

ExploitIQ

⚡ ExploitIQ Autonomous AI-Powered Penetration Testing Assis...

langchain-anthropic (>=0.2.0.dev0, <=0.2.0.dev1), langchain-aws (0.2.0.dev1) +12 more potentially affected by CVE-2026-34070 via langchain-core (0.4.0.dev0)

langchain-core PYPI version 0.4.0.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langchain-anthropic =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.3.0.dev0, =0.1.0.dev0, =0.1.0.dev1 Source cves:...

MAL-2026-913 Malicious code in groq-ppe-pkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 517d20a09a1e53ce02484aa25ab2483ef75022e96f76d72fe3125bc1e16a359d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

langchain-anthropic (>=0.2.0.dev0, <=0.2.0.dev1), langchain-aws (0.2.0.dev1) +12 more potentially affected by CVE-2026-26013 via langchain-core (0.4.0.dev0)

langchain-core PYPI version 0.4.0.dev0 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - langchain-anthropic =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.2.0.dev0, =0.3.0.dev0, =0.1.0.dev0, =0.1.0.dev1 Source cves:...

aiconfig-extension-gemini (0.0.5), aideml (>=0.1.0, <=0.2.2) +76 more potentially affected by CVE-2025-71176 via pytest (7.4.3)

pytest PYPI version 7.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - aiconfig-extension-gemini 0.0.5 - aideml =0.1.0, =0.1.0, =0.1.0, =4.0.0, =0.1.8, =0.0.3, =2.0.7, =0.0.1, =1.0.3, =1.0.4 and more Source cves:...

MAL-2025-21941 Malicious code in groq-appgen (npm)

The package groq-appgen was found to contain malicious code...

Malicious code in groq-appgen (npm)

The package groq-appgen was found to contain malicious code...

MAL-2025-6007 Malicious code in groq-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f310f1669db9ce74e36d92085a6a67098f7c0ee086d8da5998b709d565a3fe12 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in groq-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f310f1669db9ce74e36d92085a6a67098f7c0ee086d8da5998b709d565a3fe12 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malware in groq-link

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-6093 Malicious code in groq-link2 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 41bce2830a85a25120da79481083dd6be69ce23b29f67ed7678a9009bbdb71f7 The OpenSSF Package Analysis project identified 'groq-link2' @ 1.0.23...

Malicious code in groq-link2 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 41bce2830a85a25120da79481083dd6be69ce23b29f67ed7678a9009bbdb71f7 The OpenSSF Package Analysis project identified 'groq-link2' @ 1.0.23...

MAL-2025-5413 Malicious code in groq-link (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d886914bb5385499143228e52016dd35d42665bf6d71e77ef69b13c3bc9de00 Any computer that has this package installed or running should be considered...

Malicious code in groq-link (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d886914bb5385499143228e52016dd35d42665bf6d71e77ef69b13c3bc9de00 Any computer that has this package installed or running should be considered...

This Week in Spring - August 6th, 2024

It's August! Egads, has that come quickly! AUGUST. The eigth month of the year, and we're almost done with the first week, in fact! It's not that I'm not grateful to be here, but, yah, wow that was quick. And, of course, the month of my all time double dutch favorite conference, SpringOne,...

Spring AI with Groq - a blazingly fast AI inference engine

Faster information processing not only informs - it transforms how we perceive and innovate. Spring AI, a powerful framework for integrating AI capabilities into Spring applications, now offers support for Groq - a blazingly fast AI inference engine with support for Tool/Function calling...