GO-2026-4485 vulnerabilities

Vulnerabilities for packages: k3s, kubo, ipfs-cluster, spegel...

GO-2026-5676 vulnerabilities

Vulnerabilities for packages: kyverno-policy-reporter, frp, k8sgateway, kubernetes-dns-node-cache, coredns, kubo, kyverno-policy-reporter-ui, kube-metrics-adapter, q, k3s, dkron, traefik, ipfs-cluster, spegel, kargo, teleport, jitsucom-bulker, opentelemetry-operator...

GO-2025-4017 vulnerabilities

Vulnerabilities for packages: frp, k8sgateway, kubernetes-dns-node-cache, kubo, kyverno-policy-reporter-ui, q, k3s, dkron, caddy, ipfs-cluster, spegel, traefik, kargo...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: seaweedfs, frp, k8sgateway, kubernetes-dns-node-cache, kubo, q, k3s, dkron, caddy, ipfs-cluster, spegel, traefik, kargo, buf...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: helm-push, ip-masq-agent, grafana-alloy, steampipe, wal-g, terraform, delve, migrate, dex, swagger, nri-apache, k8sgpt, nats-server-config-reloader, timescaledb-tune, ini-file, opentofu, polaris, harbor-registry, kubernetes-csi-driver-nfs, kube-bench,...

GHSA-34RH-WP3J-6CXC vulnerabilities

Vulnerabilities for packages: op-geth, kubo, k3s, ipfs-cluster, spegel...

CVE-2026-54908 vulnerabilities

Vulnerabilities for packages: telegraf, kubo, k3s, ipfs-cluster, spegel...

CVE-2026-54909 vulnerabilities

Vulnerabilities for packages: op-geth, kubo, k3s, ipfs-cluster, spegel...

GHSA-WG4G-WM44-CH5J vulnerabilities

Vulnerabilities for packages: telegraf, kubo, k3s, ipfs-cluster, spegel...

autonet-computer (>=0.1.2, <=0.7.3), diap-sdk (>=0.1.4, <=0.1.5) +6 more potentially affected by unknown CVE via libp2p (>=0.1.1, <=0.7.0)

libp2p PYPI version =0.1.1, =0.1.2, =0.1.4, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.0a28, =0.1.0a36 Source cves: unknown CVE Source advisory: SNYK:PYTHON-LIBP2P-18313058...

Malicious code in eth-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f051957ac6f91e8567df873978b45c0c81a170f94decbd735d329f312ff1bb On require, index.js schedules a 37-second delayed routine that reads test/fixtures/keypairs.dat, base64-decodes it into /.cache-db/.node-sync/syncd....

MAL-2026-10211 Malicious code in react-next-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286869faf09aec1d62b472e43a7188a1583c5cf8c999d1fb2e116f0b7f5ba8c6 The package impersonates the pino logger README/badges reference pino; module.exports.pino is the middleware while its name is react-next-vite. When ...

Malicious code in jupiter-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e0901ca45da110106c60f288b0166fc51c348a44569d7e7ff22af3d19deafe On import jupitersdk, the package's top-level init.py fetches a payload over HTTPS from a public IPFS gateway...

Malicious code in eth-agent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3131490d64c4ae90de2926ca90f6fce23e6a113d1e6538db5ce98ffcf06983d1 The top-level ethagent/init.py performs an outbound HTTP fetch to a hardcoded IPFS gateway URL...

Malicious code in solidity-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30501f6602a5b5b436ef5d6224ec332fa866c9e8b9da4d0de3bc69de868b1fff soliditydev/init.py contains a large base64-encoded Linux x8664 ELF binary in PAYLOADB64. On import soliditydev, the module decodes the blob, writes ...

MAL-2026-10155 Malicious code in notify-funcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b65341bde476af6b80e1fbaa9f9a844b7fdc023ef02f5fabb88514d88012159 The package presents itself as a pino-compatible logging middleware exports check as both default and pino named export but its actual behavior on...

MAL-2026-10077 Malicious code in type-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b5cd26e040f4f4366ed65cca4b70258d276f781e0aab76b99b5573d4007a97d The npm package [email protected] masquerades as the pino logger copied module layout, exports as module.exports.pino, keywords fast/logger/stream/jso...

MAL-2026-10014 Malicious code in nodemon-sudo (npm)

The npm package nodemon-sudo is a typosquat of the popular nodemon package: its package.json description "Simple monitor script for use during development of a Node.js app.", main entry ./lib/nodemon, and forged author field Remy Sharp, the real maintainer of nodemon are copied from the legitimat...

Malicious code in tslint-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31b464b1646f8e2d36ce68a86af599cc49d5381f08af70302ff01f42957234a1 The package presents itself as the pino logger README, index.d.ts, docs/, and lib/ files all reference pinojs/pino but is published under the unrelat...

MAL-2026-4348 Malicious code in api-rs-node (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...