Malicious code in messenger-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo.username, home directory, DNS servers and...

MAL-2026-12796 Malicious code in messenger-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48e89235ade6dcbf682edae5afb7d789c6a834b2ebe032fac72c796734837d10 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo.username, home directory, DNS servers and...

MAL-2026-12790 Malicious code in glia-functions-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e24f6c700225d22dcccdf1af7bb58c7628366ccc59b864431af5123909b42626 package.json's preinstall hook runs index.js, which collects hostname, username, home directory, DNS servers, and current working directory, reads...

MAL-2026-12787 Malicious code in dynstrg-howto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 800fab99d95f1a2cef6ebf269ca240bf60518735cfb58c7c24b6a8474c72ee77 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in dynstrg-howto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 800fab99d95f1a2cef6ebf269ca240bf60518735cfb58c7c24b6a8474c72ee77 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

MAL-2026-12809 Malicious code in technical-challenge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6921f72a1b4fbaaba87fcbe3cb30137815e7e2bb932ffa794acd0010b8954c5f package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects installer-side data —...

Malicious code in wolverinechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ad1c6bad5ee8d3cb562503b94d5534ba2c98ad5b4854c073e1482d59ab8687e package.json declares a preinstall hook that runs index.js during npm install. The script reads /etc/passwd, /etc/hosts, os.hostname,...

Malicious code in token-list-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0c4aa27fc6318b8e3b7e2ec6718d3254147df0032799c5667dd8e88a24ca188 On require, index.js schedules a delayed HTTPS POST that transmits the full process.env object along with os.hostname, os.userInfo.username, and...

Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in rpc-endpoint-rotator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eda47a0d1da23b08d63a5fa4339234b9a19bc7aedf7b74d060731b24841be2a index.js schedules a top-level POST on module load to https://enjbyg3xk8l.x.pipedream.net/beacon carrying the entire process.env plus OS hostname,...

Malicious code in @offa-uwk/offa-uwk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2 On npm install, the package's postinstall script node index.js collects host identifiers os.hostname, os.userInfo.username, process.cwd and POSTs the...

Malicious code in tracker-radar-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1 package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, D...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

CVE-2026-71231 IOTSmartHome - Unauthenticated SQL Injection via lastLogin Cookie

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

Link following vulnerability allows arbitrary file creation

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives. This allows attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-66065: External Control of System or Configuration Setting

Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have an incomplete denylist. Several execution-routing keys of the same RCE class were omitted, so a malicious cloned repo can still...

Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f5e3f7f8e637ac814a5040b2e61c8608327f73b1c44352e694848a8c35e181 On import, server.py starts a background thread that issues an HTTP GET to the hardcoded bare-IP endpoint http://187.127.73.142:8777 carrying a...

MAL-2026-11198 Malicious code in mcp-search-server (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03f5e3f7f8e637ac814a5040b2e61c8608327f73b1c44352e694848a8c35e181 On import, server.py starts a background thread that issues an HTTP GET to the hardcoded bare-IP endpoint http://187.127.73.142:8777 carrying a...

SUSE CVE-2026-47703

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dnsid=0 or txid=0 and exposed a quoted-port ICMP source-port oracle, weakening DNS response...

SUSE CVE-2026-62685

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername when Signup=true and CreateUserDir=true, but the many-to-one...