1430 matches found
[SECURITY] Fedora 43 Update: log4cxx-1.7.0-2.fc43
Log4cxx is a popular logging package written in C++. One of its distinctive features is the notion of inheritance in loggers. Using a logger hierarchy it is possible to control which log statements are output at arbitrary granularity. This helps reduce the volume of logged output and minimize the...
Malicious code in sync-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37fba87304c3a7ede2f03b87c89b49a3fb9b7f201befbaf79312da2cce65abc4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-10568 Malicious code in sync-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37fba87304c3a7ede2f03b87c89b49a3fb9b7f201befbaf79312da2cce65abc4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-10555 Malicious code in @codex2005/logger-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f14223b7d9b3039682e27372df81a552cc1b451a99d60d5ec79e0d4696a7b800 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10516 Malicious code in polymarket-bot-logger (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16019aad4a4500c2df862c6b811c97b0fe227673fd10d921a453924410d17948 On npm install, the package's postinstall hook runs install-check.cjs, which fetches a JSON config from https://jipred.vercel.app/config/clob-math.js...
Malicious code in @spzhongwin/skill-logger-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970980f38a6389d5b622ca41ba3b418f1538b2a38f595536c97acb934012b8b9 The package advertises itself as a skill usage/error logger but, when activated via the openclaw gatewaystart hook, opens a persistent WebSocket to a...
MAL-2026-10440 Malicious code in type-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6706d0ad662da8d23eaf47c64780a777f3ec215d8864caf1e0962289463efb The package presents itself as a logger module.exports.pino, keywords fast/logger/stream/json, pino-like sibling files...
MAL-2026-10418 Malicious code in note-utilities (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f093c8536c89f9d6c524ae212051fc45a5244d910afd8ee3abe30698f15b75d The package masquerades as a pino-style logger keywords fast/logger/stream/json; lib/ contents copied from pinojs/pino but ships an additional loader...
[SECURITY] Fedora 44 Update: log4cxx-1.7.0-2.fc44
Log4cxx is a popular logging package written in C++. One of its distinctive features is the notion of inheritance in loggers. Using a logger hierarchy it is possible to control which log statements are output at arbitrary granularity. This helps reduce the volume of logged output and minimize the...
MAL-2026-10185 Malicious code in authvaultx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c707d53e30a333f8b8cf03ac2480eee3e2fa9c3c3164b1a100d333c91f9f3a On require of authvaultx main: auth.js, which loads lib/writer.js, top-level code attempts to load the separately published npm package...
MAL-2026-10154 Malicious code in notify-dist (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf89f8fbe4c3f9ae9494077688977f46c8b3f875a552054508ac5eec7b62344 notify-dist advertises itself as a pino-compatible logger/middleware exports module.exports.pino, keywords fast/logger/stream/json, lib/ mirrors pino...
MAL-2026-10082 Malicious code in chain-async-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54cd392461a3d805dd24f6bc67d354498531f9b42352e8e0c17205351dcccf0b The package presents itself as a pino-compatible logger lib/ directory mirrors pino's internal file layout — proto.js, levels.js, redaction.js,...
MAL-2026-10049 Malicious code in chai-await-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e78d8b4da2e781df4437569123ba3913c3f0135bbef66addaa5766a109fdd98b The package impersonates a pino-style logger API but its exported middleware spawns a detached Node child process that runs lib/caller.js. caller.js...
MAL-2026-10056 Malicious code in chain-chai-await (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dc585524bcc3e64a107006ba8c763591b071bb174c7acadd716b6e99ac1c34 The package presents itself as a pino-compatible logger exports pino, mirrors pino's lib/ layout with...
Malicious code in tslint-conf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31b464b1646f8e2d36ce68a86af599cc49d5381f08af70302ff01f42957234a1 The package presents itself as the pino logger README, index.d.ts, docs/, and lib/ files all reference pinojs/pino but is published under the unrelat...
PYSEC-2026-1633 ml-logger deserialization vulnerability
A vulnerability was determined in geyang ml-logger 0.10.36 and prior. Affected is the function loghandler of the file mllogger/server.py of the component Ping Handler. This manipulation of the argument data causes deserialization. It is possible to initiate the attack remotely. The exploit has be...
PYSEC-2026-1635 ml-logger file handler allows reading arbitrary files
A security flaw has been discovered in geyang ml-logger up to acf255bade5be6ad88d90735c8367b28cbe3a743. Affected by this issue is the function streamhandler of the file mllogger/server.py of the component File Handler. Performing manipulation of the argument key results in information disclosure...
PYSEC-2026-1634 ml-logger has path traversal in the file argument
A vulnerability was identified in geyang ml-logger 0.10.36 and prior. Affected by this vulnerability is the function loghandler of the file mllogger/server.py. Such manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit is publicly...