MAL-2026-11000 Malicious code in application-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07fa5354b40e3efac6ff8738892aa26cb710e6aff3caca516f563502ef4a4d43 On npm install, scripts.postinstall runs test.js which performs three attacker-beneficial actions against the installer's host. 1 Backdoor: fetches a...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

Malicious code in encrypt-string-ttak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf72c81030b9346ff3d3dd6f2e5f3395a61d433def25e5e2ea2a7e52a6051999 The package is published as a UniApp 'encryptString' helper but its single shipped module dist/encrypt-string.js is heavily obfuscated obfuscator.io...

Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

MAL-2026-11012 Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

GO-2026-6037 Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload in gitea.dev

Gitea: Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload in gitea.dev...

Malicious code in app-data-ist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...

GHSA-C97M-VXHJ-P7J6 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-gamelift-fips, crossplane-provider-aws-macie2-fips, crossplane-provider-aws-securityhub, crossplane-provider-aws-codestarnotifications-fips, crossplane-provider-aws-networkfirewall-fips, glab, crossplane-provider-aws-ssm-fips,...

CVE-2026-5160 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-gamelift-fips, crossplane-provider-aws-macie2-fips, crossplane-provider-aws-securityhub, crossplane-provider-aws-codestarnotifications-fips, crossplane-provider-aws-networkfirewall-fips, glab, crossplane-provider-aws-ssm-fips,...

GHSA-X5MV-8WGW-29HG vulnerabilities

Vulnerabilities for packages: ascan...

CVE-2026-55093 vulnerabilities

Vulnerabilities for packages: ascan...

GHSA-52CP-R559-CP3M vulnerabilities

Vulnerabilities for packages: vitess, kubeflow-centraldashboard, opensearch-dashboards, prism, code-server, pulumi, lerna, ts-patch, sqlpad, eslint...

CVE-2026-59869 vulnerabilities

Vulnerabilities for packages: vitess, kubeflow-centraldashboard, opensearch-dashboards, prism, code-server, pulumi, lerna, ts-patch, sqlpad, eslint...

GHSA-5GVW-P9QM-JGWH vulnerabilities

Vulnerabilities for packages: akhq, spark, infinispan, scala, confluent-kafka, apache-nifi-registry, opensearch, strimzi-kafka-operator, zookeeper, apicurio-registry, logstash, druid, gradle, wavefront-proxy, cassandra, apache-nifi, ruby3.3-jrjackson, flyway, jenkins-plugin-manager, sonarqube,...

GHSA-MHM7-754M-9P8W vulnerabilities

Vulnerabilities for packages: akhq, spark, infinispan, confluent-kafka, opensearch, zookeeper, logstash, druid, gradle, wavefront-proxy, cassandra, ruby3.3-jrjackson, flyway, jenkins-plugin-manager, sonarqube, keycloak-config-cli, tez, ruby3.2-jrjackson, apache-tika, thingsboard...

GHSA-C97M-VXHJ-P7J6 vulnerabilities

Vulnerabilities for packages: vale, crossplane-provider-family-azure, crossplane-provider-aws-rds, crossplane-provider-aws-sns, mattermost, crossplane-provider-aws-s3, nuclei, crossplane-provider-aws-firehose, crossplane-provider-aws-eks, crossplane-provider-aws-dynamodb,...

CVE-2026-5160 vulnerabilities

Vulnerabilities for packages: vale, crossplane-provider-family-azure, crossplane-provider-aws-rds, crossplane-provider-aws-sns, mattermost, crossplane-provider-aws-s3, nuclei, crossplane-provider-aws-firehose, crossplane-provider-aws-eks, crossplane-provider-aws-dynamodb,...

GHSA-JPJM-C3R5-Q96R vulnerabilities

Vulnerabilities for packages: sftpgo-plugin-eventstore, fuse-overlayfs-snapshotter, falcoctl, kyverno-notation-aws, terraform, tekton-chains, amass, blob-csi, crossplane-provider-aws-s3, k8ssandra-client, k8s-device-plugin, mongo-tools, nsc, openfga, crossplane-provider-aws-eks,...