MAL-2026-2872 Malicious code in ts-form-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f2ff1bf87164fdeb2ca9c37d578f7156164a344ffd11bcdb84ce34880358fea The package ts-form-helpers was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in paysafe-venmo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fce8d34aa19e18a627c71bd9fd4d16246319ca05abafd983708a534663a573f The package paysafe-venmo was found to contain malicious code. Source: ghsa-malware 678a8d684fa9e6f72f98c45d404c3e749491bd582d4b78ddc4bc3d020ae3c172...

CVE-2026-35641

OpenClaw before 2026.3.24 contains an arbitrary code execution vulnerability in local plugin and hook installation that allows attackers to execute malicious code by crafting a .npmrc file with a git executable override. During npm install execution in the staged package directory, attackers can...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: nodejs22: nodejs22-22.22.0-1.3.hum1 aarch64, x8664 nodejs22-bin-22.22.0-1.3.hum1 noarch nodejs22-devel-22.22.0-1.3.hum1 aarch64, x8664 nodejs22-docs-22.22.0-1.3.hum1 noarch...

@saasmakers/ui (>=0.1.88, <=2.0.71), @styleframe/docs (>=1.1.0, <=2.0.1) +12 more potentially affected by CVE-2026-39315 via unhead (>=2.0.0, <=2.1.12)

unhead NPM version =2.0.0, =0.1.88, =1.1.0, =2.0.0-alpha.19, =2.0.0-alpha.9, =2.0.0-alpha.0, =2.0.0-alpha.18, =2.0.0-alpha.17, =2.0.0-alpha.0, =1.2.0, =0.0.2, =0.17.0, =2.0.0-alpha.8, =0.1.0-beta.10, =0.1.0-beta.14 Source cves: CVE-2026-39315 Source advisory: SNYK:JS-UNHEAD-15965923...

GHSA-CCX3-FW7Q-RR2R OpenClaw: Multiple Code Paths Missing Base64 Pre-Allocation Size Checks

Impact Multiple Code Paths Missing Base64 Pre-Allocation Size Checks. Several base64 decode paths could allocate before enforcing decoded-size limits. OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service...

MAL-2026-2523 Malicious code in @telekom-wfa/auth-core (npm)

Package is malware. Hardcoded Telegram credentials, data exfiltration, and preinstall script execution indicate malicious intent. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2fe12e5542ae8cf1cf339c13c3480629ccfd6e2fb391427c4f1b17bbdc9f85 The package...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs:...

PT-2026-31732

Name of the Vulnerable Software and Affected Versions Helm versions 3.20.1 and earlier, and versions 4.1.3 and earlier Description Helm, a package manager for Kubernetes Charts, is affected by an issue where a specially crafted Chart can cause the helm pull --untar command to write chart contents...

DEBIAN-CVE-2026-39860

Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds typically the Nix daemon running as root in multi-user installations by following symlinks during...

EUVD-2026-20626

Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating the builds typically the Nix daemon running as root in multi-user installations by following symlinks during...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs:...

N. Korean Hackers Spread 1,700 Malicious Packages Across npm, PyPI, Go, Rust

The North Korea-linked persistent campaign known as Contagious Interview has spread its tentacles by publishing malicious packages targeting the Go, Rust, and PHP ecosystems. "The threat actor's packages were designed to impersonate legitimate developer tooling ..., while quietly functioning as...

Nix 安全漏洞

Nix is a package manager developed by Nix itself. There were security vulnerabilities in versions of Nix prior to 2.34.5, as well as versions before 2.33.4, 2.32.7, 2.31.4, 2.30.4, 2.29.3, and 2.28.6. These vulnerabilities stemmed from improper handling of symbolic links, which could lead to...

MAL-2026-2865 Malicious code in @sie-ppr-web-checkout/app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 977089aabb00f7d390dd6bf7ad3e9038c4998ec2ccf93a2e38016f525c32f368 The package @sie-ppr-web-checkout/app was found to contain malicious code. Source: ghsa-malware...

Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do

Threat actors leveraged Anthropic’s Claude Code npm release packaging error to distribute Vidar, GhostSocks, and PureLog Stealer. This blog details immediate steps organizations can take and best practices to prevent further risk...

@ablehi/automation-app-build (>=0.1.0, <=0.1.22), @ablehi/automation-app-cli (>=0.1.0, <=0.1.22) +144 more potentially affected by CVE-2026-39365 via vite (>=8.0.0, <=8.0.3)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =3.0.1-alpha.0, =3.3.0, =11.17.0-depup.0, =35.0.0, =17.1.0, =4.0.0, =9.6.10, =0.1.0, =0.1.0, =0.0.0-experimental-04f2240-20260306-7fcde375, =0.0.0-experimental-fd6d426-20260301-87c73ec5 and more Source cves: CVE-2026-39365 Source advisory:...

@142vip/vuepress (0.0.1-alpha.19), @agregio-solutions/design-system (>=1.89.2, <=1.89.4) +235 more potentially affected by CVE-2026-39365 via vite (>=7.0.0, <=7.3.1)

vite NPM version =7.0.0, =1.89.2, =20.1.0-next.3, =20.1.0-next.3, =0.1.0, =0.0.4, =0.2.9, =0.79.1, =1.0.0, =1.0.0-beta.23, =2.1.2-alpha.0, =1.0.0-alpha.0, =2.23.0, =2.23.0, =2.35.0 and more Source cves: CVE-2026-39365 Source advisory: OSV:GHSA-4W7W-66W2-5VF9...

@142vip/vuepress (0.0.1-alpha.19), @agregio-solutions/design-system (>=1.89.2, <=1.89.4) +195 more potentially affected by CVE-2026-39364 via vite (>=7.1.0, <=7.3.1)

vite NPM version =7.1.0, =1.89.2, =20.2.0-next.3, =20.2.0-next.3, =0.1.0, =0.79.1, =1.0.0-beta.23, =2.1.2-alpha.0, =1.0.0-alpha.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.23.0, =2.35.0 and more Source cves: CVE-2026-39364 Source advisory: OSV:GHSA-V2WJ-Q39Q-566R...

CVE-2026-34841

Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions of the axios npm package, which introduced a hidden dependency deploying a cross-platform Remote Access Trojan RAT. Users of @usebruno/cli who ran...