GuardModel

GuardModel Bloquea modelos de IA maliciosos en tu pipeline con una línea de YAML. GuardModel es una GitHub Action que escanea automáticamente archivos de modelos de ML en busca de código malicioso, vulnerabilidades y riesgos de seguridad en pipelines CI/CD. Bloquea modelos peligrosos antes de que...

MAL-2026-17421 Malicious code in spo365-graph (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1 During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then...

Malicious code in spo365-graph (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ea8dd7600717964f4ca8f8b1134f867f4bf69f1538243d5c7da752eefed99fe1 During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data are then...

CVE-2026-33634-Scanner

CVE-2026-33634-Scanner Scanner automatizado para la detección de indicadores de compromiso IOCs asociados al ataque a la cadena de suministro TeamPCP CVE-2026-33634 📋 Tabla de Contenidos Descripción General Vulnerabilidad Características IOCs Detectados Instalación Uso Ejemplos Formato de Reporte...

MAL-2026-17362 Malicious code in @kelvdra/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

MAL-2026-17351 Malicious code in @bottino/baileys (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

CVE-2026-22008-AWS-Lambda-Layer-Injection-via-Shared-Layer-ARN

CVE-2026-22008 – Inyección de capa de AWS Lambda mediante ARN de capa compartido Código del programa Python deployvulnerablelambda.py - Lambda function using a layer from untrusted account import boto3 lambdaclient = boto3.client'lambda' Attacker publishes a public layer containing malicious code...

CVE-2026-67595

CVE-2026-67595 — JavaScript malicioso incrustado en VaahCMS Aviso de seguridad para CVE-2026-67595 : una carga útil de software espía de JavaScript ofuscada incluida en las versiones oficiales de VaahCMS un problema de cadena de suministro / código malicioso incrustado, descubierta y reportada de...

CVE-2025-32965-xrpl-js-poc

CVE-2025-32965 — Informe de PoC de Ataque a la Cadena de Suministro de xrpl.js Descripción de la Vulnerabilidad CVE Code: CVE-2025-32965 Tipo de Vulnerabilidad: Ataque a la Cadena de Suministro CWE-506: Código Malicioso Incrustado Objetivo: Versiones 4.2.1–4.2.4 y 2.14.2 de la biblioteca xrpl.js...

MAL-2026-17419 Malicious code in friendly-tools (PyPI)

friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendlygreeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copi...

CLEANSTART-2025-NL28578 Malicious code was discovered in the upstream tarballs of xz, starting with version 5

Security vulnerability affects the xz package. Malicious code was discovered in the upstream tarballs of xz, starting with version 5...

are-you-get-tanstack-attack

Escáner de CVE de TanStack Router Una herramienta de escaneo de seguridad para detectar el CVE de TanStack Router | GHSA de TanStack Router en tus proyectos. Resumen Esta herramienta escanea tu código en busca de indicadores de la vulnerabilidad de TanStack Router CVE-2026-45321 /...

CVE-2024-3094-info

CVE-2024-3094 信息 https://github.com/lockness-Ko/xz-vulnerable-honeypot https://tukaani.org/xz-backdoor/ - Lasse Collin 回应 https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27...

MAL-2026-17339 Malicious code in reactjs-risk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e58c82916c5199ef9e73a5d70f91d120312151eb5c28090d8bbf6dbf4117543 The package's preinstall lifecycle script collects host identity metadata from the installer machine — os.hostname, the output of...

MAL-2026-17334 Malicious code in @cat-gen/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f0e3ea6c673017f0f5d62fae924a120e25e8ecc3e69abba2e93042eea5d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cat-gen/materia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 354c3f4dedaabc169ba0f7a5ccb99a5a77e7ef99c194854add673e7dac98d30f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @cat-gen/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d1f0e3ea6c673017f0f5d62fae924a120e25e8ecc3e69abba2e93042eea5d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in link-status-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6269997002cfa4c9b875b692be1d084885fc31a232ebfb144ac489659d1b696e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @redman89405/my-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58f8e0d965e65d298a38295487ebe0c363ea7da343649827903915cc655f3730 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chaienv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbb73465123d4e732dae815badc8950b40e9447463c1fca697551ab3aa00e020 [email protected] is published as a small Chai environment helper, but its index.js unconditionally loads lib/config.js at require time via const config ...