MSC-2026-11650

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-11688

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11648

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

CVE-2026-82331

Improper link resolution before file access 'link following' vulnerability in the "tar" source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python "tarfile" filter functionality, which blocks the symlink escape Users are recommended to upgrad...

CVE-2026-82331 Apache BuildStream: tar source extraction escape

Improper link resolution before file access 'link following' vulnerability in the tar source plugin of Apache BuildStream running on Python = 3.12, BuildStream = 2.3.0 already makes use of the Python tarfile filter functionality, which blocks the symlink escape Users are recommended to upgrade to...

Malicious code in godzzz (npm)

Source: amazon-inspector 39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a The npm package [email protected] ships cdpinject.js which imports http, https, childprocess and fs at the top of the file, reads process.env including process.env.USER, reads files from disk via...

Malicious code in helpersutils-dev-tools (npm)

Source: amazon-inspector 85b7208dea3cf1742ac01332c17db9df968fd4a105fbccaf0b5388162b0f3673 The package presents itself as 'Development utility helpers' but its main module executes an IIFE at require-time that issues an Image request to http://5.189.173.113:8899/csp-edu with document.domain append...

Malicious code in hachutis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 455f1d04545c9ed17722705fe61415d7e536e2800c2a3c588ab69985004c73b9 The tarball ships three undeclared prebuilt executables under bin/ bin/cli, bin/cli-linux-amd64, and an 81 MB Bun-compiled bin/cli-http-linux that ar...

Malicious code in godzzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a The npm package [email protected] ships cdpinject.js which imports http, https, childprocess and fs at the top of the file, reads process.env including...

Malicious code in kerokwis (PyPI)

Source: kam193 118186230c3ddb5c23ae32df8fed10655f2c64939daa9a09d5ef71f16884a4f0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malware in uolcs-host-uol-anuncios-fe

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

Malicious code in @tvg-mar/promos-gtm (npm)

Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and on require top-level module load chain reaching...

Malicious code in eslint-config-compact-utils (npm)

Source: amazon-inspector 414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f On require, index.js collects host reconnaissance data os.hostname, os.userInfo.username, os.platform, architecture, Node version, current working directory together with CI/repository environment variables...

Malicious code in n8n-nodes-data-transformer-utils (npm)

Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocations to collect host information including reads of /etc/hos...

Malicious code in @tvg-mar/storyblok-bridge (npm)

Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loads Node built-ins os, dns, and process via...

Malicious code in @tvg-mar/utils (npm)

Source: amazon-inspector de7194acad05327ce23172c262747b8d6e57d33606580a0b9e7222d1ecfee3ab package.json declares scripts.install="node index.js", which loads runtime/index.js and then support/telemetry/probe/impl.js. That module reconstructs Node core APIs 'os', 'dns', 'process', 'userInfo',...

PT-2026-97495

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The HostList.list function catches generic exceptions and returns the error string verbatim. An authenticated user can exploit this via the host filter parameter...

PT-2026-97204

Name of the Vulnerable Software and Affected Versions Apache BuildStream versions prior to 2.8.1 Description An improper link resolution issue exists in the tar source plugin when running on Python versions prior to 3.12. This allows malicious source tarballs to write files on the host system wit...