Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

MAL-2026-15871 Malicious code in wallet-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5197e979c868a6e4ea36c49ad9cace9d5074f1deb961b35f824e3d05934113 On npm install, the package's postinstall hook src/scan.cjs walks the installer's project tree starting three directories above nodemodules and...

VulnCheck KEV: CVE-2024-11080

The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to 2.3.1 via several functions in the /includes/blocks/form-wrap/function.php file. This makes it possible for unauthenticated attackers to execute actions with...

CVE-2026-71216: Cleartext Transmission of Sensitive Information

PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to...

MAL-2026-15865 Malicious code in @avigilon/node-webrtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...

Malicious code in @avigilon/node-webrtc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 856277989637849346e759b8d07577326b164b5521ee643a84d704a457ad9f87 package.json declares a preinstall hook that runs index.js on npm install. index.js requires os, dns, https, querystring, and the package's own...

Malicious code in 0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78 The package name '0requests' is a one-character variant of the popular PyPI package 'requests'. On import of the top-level package, init.py enumerate...

Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15863 Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

CVE-2026-78676

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath. Attackers can craft config files with embedded newlines that become live git directives after any unrelated...

zafrida-ui v0.3.7

中文 | English ZAFrida UI - PyCharm Frida Plugin Current Version: 0.3.6 Project Introduction Frida GUI Tool for PyCharm/IntelliJ ZAFrida UI is a Frida graphical interface plugin integrated into PyCharm and JetBrains IDEs. It aims to solve the complexity of Frida command-line operations and script...

Fedora 45 : dracut (2026-5bf73fe397)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-5bf73fe397 advisory. - fixdevicetree-firmware: include soc specific firmwares in installgeneric - fixdevicetree-firmware: include Qualcomm X2 laptop model specific firmwares -...

A Blind Trust, the Bloody Thrust: When Attacker-Controlled Hook Updates Steer AI Agent Harnesses Towards Malicious Behaviors

Modern AI agent harnesses expose lifecycle hooks that bind shell commands to runtime events such as session start, tool calls, and file edits. These commands run with host privileges yet ship as lifecycle-hook configuration and may fire at times the LLM never observes. We identify the...

MAL-2026-15821 Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

Malicious code in @stellarshift/abi-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebef764845634817dcc9905a146c3ba898707dcc9937ebfe0060a4f10852d27 On npm install, the package's postinstall hook resolves a URL that is stored as an XOR-encoded integer array in endpoint-registry.json self-labeled...

MAL-2026-15824 Malicious code in @stellarshift/token-units (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4433d82919da9c0972986247dd611eae3997b28fd54726ffbf9c48147c05211 Package advertises BigInt token-unit conversion helpers parseUnits/formatUnits but declares a postinstall hook scripts/postinstall.js that invokes...

secretlint v13.0.5

Secretlint Secretlint is a Pluggable linting tool to prevent committing credentials. Features Scanner : Find credentials in a project and report these Project Friendly: Easy to set up your project and integrate CI services Pre-Commit Hook : Prevent committing credential files Pluggable : Allow...

Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

EUVD-2026-69716

A Server-Side Request Forgery SSRF vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a...