613830 matches found
MAL-2026-11066 Malicious code in @ks-radar/radar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe5f14a06be3c24f9b771e8bbe33139614129069d276962f0c7e019fd89cbce On npm install, the package's preinstall lifecycle script preinstall.js reads a hex-encoded command string from preinstall.json, decodes it via...
Malicious code in @ks-radar/radar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe5f14a06be3c24f9b771e8bbe33139614129069d276962f0c7e019fd89cbce On npm install, the package's preinstall lifecycle script preinstall.js reads a hex-encoded command string from preinstall.json, decodes it via...
MAL-2026-11067 Malicious code in blessclient (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82efbe82f1f4cdc513a33b4deeb7a811318155aaf4de1d4319dc54f8730f409b The package name matches Lyft's internal python-blessclient and is published on the public index as a dependency-confusion tripwire. setup.py overrid...
Malicious code in blessclient (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82efbe82f1f4cdc513a33b4deeb7a811318155aaf4de1d4319dc54f8730f409b The package name matches Lyft's internal python-blessclient and is published on the public index as a dependency-confusion tripwire. setup.py overrid...
GHSA-V74W-7MR3-4QG3 vulnerabilities
Vulnerabilities for packages: hadoop-fips, apache-hop-fips, management-api-for-apache-cassandra-5.0, apache-hop, thingsboard, tinkerpop, seata, tez...
GHSA-6P8H-3WGX-97GF vulnerabilities
Vulnerabilities for packages: jupyter-all-spark-notebook, opal, awx, datahub-ingestion-fips, datahub-ingestion, mlflow, mlflow-fips...
GHSA-3RP5-JJMW-4WV2 vulnerabilities
Vulnerabilities for packages: jupyter-all-spark-notebook, opal, awx, datahub-ingestion-fips, datahub-ingestion, mlflow, mlflow-fips...
GHSA-V74W-7MR3-4QG3 vulnerabilities
Vulnerabilities for packages: thingsboard, tez, management-api-for-apache-cassandra-5.0...
GHSA-G35J-M5XG-VH3Q vulnerabilities
Vulnerabilities for packages: spegel, ipfs-cluster, k3s, kubo...
Malicious code in swiper_angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...
MAL-2026-11065 Malicious code in swiper_angular (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a523a0f2bb0df423657f50e42be71ae87d3071b859e1f4eb88a90709ba0ca5 Package name typosquats swiper/swiper-angular at implausible version 5.9999.1. The preinstall.js script runs at install time and collects installer...
Malicious code in whs4_deu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute filename path which...
MAL-2026-11070 Malicious code in whs4_deu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7dc2cf8fe83229aec6f45e6008ce2b353039a87607b930eb44928f97538c package.json declares a postinstall hook that runs index.js on npm install. On execution, index.js POSTs the installer's absolute filename path which...
Malicious code in wsh4_edu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...
MAL-2026-11072 Malicious code in wsh4_edu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0757eee7b6324baca2e2b28261c7ff072c60d578c827a14c1fa54f690b1cd53a The package's postinstall hook runs index.js, which POSTs the installer's absolute filesystem path via filename with sendFullPath: true, Node.js...
Malicious code in whs4_eud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5 [email protected] declares a postinstall lifecycle script node index.js that fires unconditionally on npm install. On execution, index.js POSTs...
MAL-2026-11071 Malicious code in whs4_eud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be47b29c887fd54b5cffc8789278f3ea7987b12d618e89c540e5670edea12b5 [email protected] declares a postinstall lifecycle script node index.js that fires unconditionally on npm install. On execution, index.js POSTs...
GHSA-XX22-P4CH-683R vulnerabilities
Vulnerabilities for packages: metabase, pinot-fips, cassandra, conductor-fips, confluent-kafka-jre-bcfips, logstash-fips, thingsboard, knative-kafka-broker, elasticsearch, nuxeo, traccar-fips, akhq, apicurio-registry, pinot, opensearch, wildfly, debezium-connector-vitess, druid, hadoop-fips,...
GHSA-XQP3-JQ6G-X3QM vulnerabilities
Vulnerabilities for packages: filebrowser...
Malicious Package
Overview -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, the...