Malicious code in intel-cicd-repo-infrastructure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-44192

CVE-2026-44192 affects the Ansible Lightspeed Model Context Protocol (MCP) server. The vulnerability is a path traversal flaw that can be triggered to manipulate an AI agent via indirect prompt injection, allowing writing of files to unauthorized locations on the user’s system, which may expose s...

PT-2026-63365

A flaw was found in the Ansible Lightspeed Model Context Protocol MCP server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to write files to unauthorized locations on the...

CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...

MAL-2026-10760 Malicious code in abseil-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6b0ae8e92b62a5524d9ca665a07b3139a9cd4af2af0a0016dc6d425ecc2cc72e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99621af0900df34246c87811ea5c2a643f2b3805601136dcc0a6768e48af925f The PyPI package captcha-solve-api contains no captcha functionality and is instead a binary dropper disguised as an analytics SDK. A custom setuptoo...

MAL-2026-10683 Malicious code in formatters.ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21827129edc8dbde114c615df656d5a234d1fbcfa5b9f63d5286d781253e8f2b The package declares a preinstall hook that runs index.js on npm install. index.js collects host and identity reconnaissance — os.hostname,...

Malicious code in cosmos-cuda (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a96e5776ec64356f639738134c95a2f33233a4275d2d0ddd6b174c297c64ee The sdist-only package cosmos-cuda 9999.0.0 executes a beacon function beacon'build' from setup.py during sdist build/install and beacon'import' from...

MAL-2026-10615 Malicious code in smb-common-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66072ca2fc20c19a01d0a2b888d90632a7d9bfdc34a2d1a71b61ad06975eae5c package.json declares a preinstall hook that runs index.js. On npm install, index.js collects host reconnaissance from the installer os.hostname,...

Malicious code in @public-for-cdao/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a893631e8d2b076ee2c69cfd1126c435c70c02ecb912ef1e6ae383d7f34d78d The package ships a postinstall script recon.js that runs at npm install time. It collects host identifiers hostname, platform, arch, username, cwd,...

MAL-2026-10590 Malicious code in openaiwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...

Malicious code in api-changelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname,...

Malicious code in consumerweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance os.hostname, os.userInfo.usernam...

Malicious code in ap3-components-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d97e0570ae62fdcbbbd0f4cd4844cf39d0b77a0d4bb346dd6dcb748f0300c43 Package 'ap3-components-ui' at version 9.999.0 declares a preinstall hook "node index.js /dev/null 2&1" that shells out to collect installer-side...

MAL-2026-10084 Malicious code in conversionvaluemanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21445a74cc1c4d33c89f1a7d8c357c79d5adb11cda135c813676b23c875418e9 On npm install, postinstall.js automatically runs and gathers installer-identifying data os.hostname, os.userInfo, os.platform, cwd, Node version,...

MAL-2026-7011 Malicious code in events-alias (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 164642716a755117674746c1c2534b0ac47d56bed2348e7a800c3d37a98074e9 The package's preinstall hook "node index.js" runs automatically on npm install and executes an exfiltration payload. index.js requires childprocess,...

MAL-2026-6997 Malicious code in goofy-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 779daa3389f4ff3ea7ca2acb4e0202b4465e90fa0d8b7bdcc0e3785f34e454a2 [email protected] is a dependency-confusion squat: the version is inflated to 9999.0.0 to shadow an internal package of the same name in build syste...

MAL-2026-6987 Malicious code in @luminarycloudinternal/lcvis-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8dffb72c9f767cbd071bf482fce9acb1ff2283a4800b7862739348b7a89e24 Package @luminarycloudinternal/[email protected] is published to the public npm registry under an internal-looking scope with an artificially high...

MAL-2026-6733 Malicious code in epic-build-scripts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14d466b50466bb93e6e9130d18e67b680c7255beecafe16043dc5ee51bfec886 On import epicbuildscripts, the package's top-level init spawns a background thread that POSTs a JSON payload containing socket.gethostname, the...

MAL-2026-6673 Malicious code in anthropic-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90ec82c6478e3a82eac71597b1c1fffc17d1b138e11e1a2aeadec7c00344c65e [email protected] is a typosquat against the @anthropic-ai/sdk ecosystem. The package ships no library code — its declared main dist/index.js i...