RockyLinux 9 : ansible-core (RLSA-2026:57149)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57149 advisory. ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332 Tenable has extracted the preceding description...

Oracle Java SE Multiple Vulnerabilities (August 2026 CSPU)

The 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2 versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the August 2026 CSPU advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of...

RockyLinux 10 : ansible-core (RLSA-2026:57148)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57148 advisory. ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332 Tenable has extracted the preceding description...

MAL-2026-14310 Malicious code in bunnyhijack-test-0x00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b21307c316c7a3237991fdfb6dc4d43716997a91268f43fe9c9c65a3fd76e package.json declares "bin": "node": "./shim.js" , which causes npm to place a node executable into nodemodules/.bin. Since nodemodules/.bin is...

EUVD-2026-62471

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76230

Renovate (renovatebot/renovate) versions 35.63.0 through 40.32.x contain a command injection vulnerability in the npm manager . The root cause is that user-provided packageName values are appended to npm install commands in lib/modules/manager/npm/post-update/npm.ts without being escaped via the ...

Malicious code in localize-translate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a4a3b42b13a5ba692edd9761c2d32d6682f555828df49cb44e40b623861a1f0 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, arch, node version, package name,...

Malicious code in nibra1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4521ad8bc5159d00d7ab74f0911028637749bd2a7a346e8f134ad78ef8630aee The package's CLI entry index.js launches a Python payload pointer.py that registers global keyboard hooks, polls the clipboard, captures screenshots...

MAL-2026-14275 Malicious code in minequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54dfa76784b35d5d63fa89a85c071e83d21e55291871b40627c36015291f24a1 package.json declares a postinstall hook running scripts/init.js, which chmod 0755's assets/thanks-amd64.elf and execFileSync's it on Linux x64 durin...

MAL-2026-14277 Malicious code in o0o9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d425848ef7172faf5f84ff9bd9017bf3ab1eb2343a5301ff0df1711d091118 The package's main entry index.js imports childprocess at the top of the file and invokes spawn"powershell",... as a top-level side effect line 27...

MAL-2026-14252 Malicious code in npm-wold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1 [email protected] declares a postinstall script node dist/config.js that, on npm install, issues an HTTPS GET to the hardcoded endpoint...

Malicious code in sysc1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2246c45afa73830233fa107ca0b97d96b10b59169599d248f7327d4e5317ff9f Package declares itself a 'System binary configuration tool' but ships a coordinated surveillance payload. package.json main is index.js which invoke...

MAL-2026-14204 Malicious code in @sarex-team/sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b599c4cb22f02d79a217a53a61243a08017783b2a8d41afaa59b46128d863c2 Package declares scripts.install="node index.js", which top-level requires lib/core.js. lib/core.js reads os.userInfo.username, os.hostname, and...

Malicious code in @sarex-team/translator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6 The package's install lifecycle script scripts.install="node index.js" automatically executes on npm install and loads lib/core.js. That module reads...

MAL-2026-14205 Malicious code in @sarex-team/translator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bccb8e95706f8ed3fe0408d43f6e043f6db71126f1951dda76bda7dfcc134e6 The package's install lifecycle script scripts.install="node index.js" automatically executes on npm install and loads lib/core.js. That module reads...

MAL-2026-14197 Malicious code in twapfetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c319f6606c9407d69fa80de43ddc3b133cba284d9356a27cc12d37b3de036b3f [email protected] ships a postinstall script scripts/install-check.cjs that, on npm install, resolves a tarball URL from environment variables...

ALSA-2026:57148 Important: ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

PT-2026-80671

Stata Command Injection via Unsanitized package in ado package install Summary The ado package install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can invoke the MCP tool or the equivalent...

Malicious code in lodsh-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273 lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...