Malicious code in crylto-toolbox (RubyGems)

RubyGems runs this gem's native extension script ext/crylto-toolbox/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

MAL-2026-17591 Malicious code in crylto-toolbox (RubyGems)

RubyGems runs this gem's native extension script ext/crylto-toolbox/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in web3-sign-helper (RubyGems)

RubyGems runs this gem's native extension script ext/web3-sign-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 30...

Malicious code in hdkey-derive-helper (RubyGems)

RubyGems runs this gem's native extension script ext/hdkey-derive-helper/extconf.rb during gem install. The script exits without action on CI runners and sandboxes, based on CI environment variables, the hostname, the username and the working directory. It continues if the system uptime is over 3...

CVE-2026-45321-Tanstack

공급망 공격 시뮬레이션 — CVE-2026-45321 TanStack npm 공급망 공격, CI/CD 악용, 설치 시 코드 실행 이해를 위한 교육용 랩 면책 조항 이 프로젝트는 오직 다음을 위해 만들어졌습니다: 사이버 보안 학습, 방어적 보안 연구, 로컬 랩 시뮬레이션, 공급망 공격 개념 이해. 이 프로젝트를 다음 용도로 사용하지 마십시오: 실제 시스템 공격, 자격 증명 탈취, 악성코드 배포, 무단 액세스, 또는 기타 불법 활동. 설명 이 랩은 다음 사고의 기본 개념을 시뮬레이션합니다: CVE-2026-45321 TanStac...

CVE-2026-45321-Tanstack

Supply Chain Attack 시뮬레이션 — CVE-2026-45321 TanStack npm 공급망 공격, CI/CD 악용 및 설치 시 코드 실행을 이해하기 위한 교육용 랩 면책 조항 이 프로젝트는 다음 만을 위해 만들어졌습니다: 사이버 보안 학습, 방어적 보안 연구, 로컬 랩 시뮬레이션, 공급망 공격 개념 이해. 이 프로젝트를 다음 용도로 사용하지 마세요: 실제 시스템 공격, 자격 증명 도용, 악성 코드 배포, 무단 접근, 또는 기타 불법 활동. 설명 이 랩은 다음 사건들의 기본 개념을 시뮬레이션합니다:...

Rocky Linux 8 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc (crlsa-2022_1792)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20221792 advisory. flatpak: Permissions granted to applications can be hidden from the user at install time CVE-2021-43860 Tenable has extracted the preceding description block direct...

CVE-2026-101044

The pacquet Rust package-manager component, included in pnpm versions >=12.0.0-alpha.0 and

Malicious code in cli-anything-ai-market (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5319f74a06670d40b020831dae38da696aa966dc1fdfde45063abb0024df922 setup.py runs automatically during pip install and POSTs the installer's OS, username USER/USERNAME, and hostname via COMPUTERNAME on Windows or the...

MAL-2026-15823 Malicious code in @stellarshift/evm-address-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ad9957f1e31e5afe261cb73c0c5b76ff23a86b23ebae0704e7e2934be79979 The package declares a postinstall script that invokes syncRemoteManifest in lib/runtime/manifest-sync.js. The destination URL is not present in...

Malicious code in sentrykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7070cc1752fa75b405bdd0617a934d29519df28fdd0d069c0d4b5f7adaf44f55 package.json declares a self-referential dependency where the key sentrykit maps to the bare HTTPS URL https://repo.securityctrl.com/sentrykit instea...

Malicious code in confluence-rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d314e75faa527b1c10dbc34b2867180fb0726f2547d9b0edd0564aec3e38fd8 package.json declares a self-referential dependency whose key equals the package's own name confluence-rest and whose value is the bare HTTPS URL...

MAL-2026-15527 Malicious code in aura-instrumentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14004b53bc245039cad1473ab4a95c2b2c8fcff2acc4b5f2c0f868da63e103bd package.json declares a self-named dependency 'aura-instrumentation' whose source is the bare URL https://repo.securityctrl.com/aura-instrumentation...

MAL-2026-15533 Malicious code in data-value (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa1f0fee2d6635331e603f520ba2954b11ac9e85bbd5b66f27c18be5940c3041 package.json declares the package's own name 'data-value' as a dependency whose source is an arbitrary HTTPS URL...

MAL-2026-14277 Malicious code in o0o9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118 The package's main entry index.js imports childprocess at the top of the file and invokes spawn"powershell",... as a top-level side effect line 27...

MAL-2026-14197 Malicious code in twapfetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c319f6606c9407d69fa80de43ddc3b133cba284d9356a27cc12d37b3de036b3f [email protected] ships a postinstall script scripts/install-check.cjs that, on npm install, resolves a tarball URL from environment variables...

Malicious code in kb-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d69143a6cdc0a652f91210034751420f7ada3db2a13d81d9e635e3a63333dc5 On import kbai, the package's init.py triggers kbai.utils.callback, which starts a background thread that collects installer host identifiers hostnam...

MAL-2026-14062 Malicious code in tw-pkgprobe-7731 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...

Malicious code in tw-pkgprobe-7731 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...

Malicious code in dlmm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 044faa804b628c1751f6fa5f66a5f8835ecda1f4d2837ae70411d4630a0607ad Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...