CVE-2026-50151

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, registry/remote/repository.go in blobStore.completePushAfterInitialPost follows a registry-controlled Location header during monolithic blob upload and reuses the Authorization header from the initial POST request for the...

CVE-2026-50151

CVE-2026-50151 affects oras-go prior to 2.6.1. During monolithic blob uploads, blobStore.completePushAfterInitialPost reuses the initial POST’s Authorization header for a subsequent PUT, while following a registry-controlled Location header. A malicious registry can return a cross-host Location a...

SUSE-SU-2026:22650-1 Security update for helm

This update for helm fixes the following issue - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens bsc1270127. Changes for helm: - Update to version 3.21.2...

CVE-2026-50573

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to bypass package integrity checks during the pnpm install process when operating in non-frozen mode. If a malicious package registry serves altered content for a locked package, pnpm may accept this new...

PT-2026-53024

Name of the Vulnerable Software and Affected Versions regclient affected versions not specified Description Authentication credentials for a registry may be leaked to external servers. This occurs when a malicious registry server, a malicious blob store, or a registry that fails to restrict...

GO-2026-4392 malcontent OCI image pull credential exfiltration via malicious registry token realm in github.com/chainguard-dev/malcontent

malcontent OCI image pull credential exfiltration via malicious registry token realm in github.com/chainguard-dev/malcontent...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the OCI image pull process. An attacker can obtain sensitive authentication credentials by crafting a malicious registry that returns a WWW-Authenticate header redirecting token authentication to...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the OCI image pull process. An attacker can obtain sensitive authentication credentials by crafting a malicious registry that returns a WWW-Authenticate header redirecting token authentication to...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the OCI image pull process. An attacker can obtain sensitive authentication credentials by crafting a malicious registry that returns a WWW-Authenticate header redirecting token authentication to...

MAL-2025-188203 Malicious code in nebula-fomalhaut-auriga-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7100d241d71061cfad199022166d5a46f9a2ac290b4e0fa6b68327aecdd9f1c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176595 Malicious code in nuilva-avmiam-rav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a0030a1a474c410466e667e3b116ec7ab6a996f7e1f871564112ad3729f594c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164643 Malicious code in rino-poke100 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bad388989d3ab49cbd1b9d86cf5f675f5a449d47cfcf46dee812a3e8d4e12654 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157686 Malicious code in kuinsnu-lki-kagbdsasodgasdfdgdgdumi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8da0576747a56fad39d11a1fee09b2429ba28517a9d87f6e6194e60b368158 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loopback-global-levels-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c51156dce9de4ef059e365316106ed44ef797131009a2bda0f1286fa23f7a3c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144698 Malicious code in markdown-pdf-oberon-rest-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6736e26ccfb46fa55ed3f0c9f17c3723e146a0902526a7486246a1f5ab8b426 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137182 Malicious code in symbolic_tortoise_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b86a8b8ce4edb6805735592d33860e2dc6f340d3403c0e0eb355be3d0bfc7df2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tomi-wajit80-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de8da48d6ae4ccd941c6a95bda54c722448cf5a4afac6f7e6b762f76fde5cf1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103431 Malicious code in gusfmbo-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbbf3e47a4a7fb232eb3a8f76e020c191686ebafa0018f3cc66416fedc3c7add This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-sasag63-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ff238bbb7a0fb3fc38ff6b7e510d282e963cde9972358a00f9de9207bd1015a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-97283 Malicious code in vivid_bird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b24778e683965e250eb68f37a739fe7a118d90df7861b2f1ae908653b8cb00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...