Malicious code in strapi-plugin-os-rec (npm)

Source: amazon-inspector 6b7f08345375bd52a25c34cc61a3e877c1a9f8f364a90a76b3a1eff55216ea03 postinstall.js runs automatically on npm install and collects host reconnaissance data — os.hostname, os.platform, os.arch, os.type, os.release, the current username, and enumeration of all network interface...

Malicious code in etoro-cashout (npm)

Source: amazon-inspector a35bbd75e3cc742fd88d59bcbb64858df0474505b5d6f93f10e8c727c718e129 The package's preinstall lifecycle script preinstall.js runs automatically on npm install and issues an HTTP GET to a hardcoded bare-IP endpoint at http://209.126.81.147/etoro-depconf-poce346552f776f/npm///,...

Malicious code in etoro-core (npm)

Source: amazon-inspector 64a03f7bbaa2cb54ffea9a0c98d22bdc2fdb0d368846beefbd8d9c3b5ab3f644 The package's preinstall lifecycle script preinstall.js issues an HTTP GET to the hardcoded bare-IP endpoint http://209.126.81.147/etoro-depconf-poce346552f776f/npm/ with os.hostname, os.userInfo.username, a...

Malicious code in etoro-api (npm)

Source: amazon-inspector ab6228f994962694d4434f53d20d6a5a1b877b39a3498236327da9d0385284d9 The preinstall lifecycle script in [email protected] preinstall.js auto-executes on npm install and performs an HTTP GET to a hardcoded bare-IP endpoint at...

Malicious code in easypanel-agent (npm)

Source: amazon-inspector 7eb103b6863369372ba8c07701264f8b0f6b57e3217e07912c8efbd9371c648f The package's preinstall lifecycle script preinstall.js executes automatically on npm install and collects the installer's hostname, OS username, current working directory, and CI-related environment variabl...

Malicious code in open-item-validator (npm)

Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from http://itemx.servegame.com:8888/api/x-realtime and executes the return...

Malicious code in tailwindcss-aspectratio-styles (npm)

Source: amazon-inspector 9b995eb02f80f9037beda9f8a864f55109e054925175289df0c1b29ed8011bc3 src/index.js, referenced by the package main and executed on require, performs an HTTP GET to http://tailwindlan.online, writes the response body to a sibling file, and immediately requires that file, giving...

CVE-2026-52769

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

Malicious code in csv-parser-helper (npm)

Source: amazon-inspector 90b87a86eaa4be59def7e48ce9b004266b8c4815a71c84fd1d3df879c702c1ca The package is advertised as a CSV parser but ships a postinstall.js that runs on npm install and performs installer-side reconnaissance and exfiltration. It shell-collects hostname, current user, working...

Malicious code in easypanel-ctl (npm)

Source: amazon-inspector e9eb01006041231d7388c6aeb0c74288b35a8c72cf5b1e61c90e1e4f9d6d37c7 On npm install, the preinstall lifecycle script collects installer host identity hostname, username, cwd and enumerates CI-related environment variable names, base64url-encodes the collected data, chunks it...

EUVD-2026-70518

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

CVE-2026-85236: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. Because bodyless GET requests are not subject to CakePHP's CSRF validation, an attacker could cause ...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-84175

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-84175: Server-Side Request Forgery (SSRF)

In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT Web of Things ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and...

CVE-2026-82263

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

CVE-2026-82263

Logto through 1.42.0 is affected by a server-side request forgery (SSRF) in the OIDC SSO connector creation endpoint . The root cause is a failure to validate the issuer URL parameter, allowing tenant administrators holding Management API credentials to supply arbitrary internal URLs that trigger...

CVE-2026-38822

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...

CVE-2026-82263: Server-Side Request Forgery (SSRF)

Logto through 1.42.0 contains a server-side request forgery vulnerability in the OIDC SSO connector creation endpoint that fails to validate the issuer URL parameter. Tenant administrators with Management API credentials can supply arbitrary internal URLs to trigger HTTP GET requests to private...

CVE-2026-38822: Improper Neutralization of Special Elements used in an OS Command

In openNDS before 11.0.0, the clientparams.sh script, invoked by the openNDS daemon to serve the authenticated client status page, is vulnerable to OS command injection through crafted HTTP GET query parameter keys. An authenticated captive portal user can inject arbitrary shell commands by...