Malicious code in weight2loss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...

Malicious code in opencode-optimised-toolings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae3527290ef726079347fab842fc46c8df96f07e2fa1734ebed7ee6ab10ed22c On plugin load, [email protected] runs SelfPatchPlugin.runSelfPatch without user prompt. It downloads an OpenCode source tarball from...

Malicious code in gpt-terminal-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached...

MAL-2026-13447 Malicious code in gpt-terminal-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached...

Malicious code in sui-graphql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1165aedcef955ec318bb0a4e8c965b41ca89ab7a2ee70d3861ae5f22cb3e2fdb Package [email protected] was scanned across 3 files with no a static rule matches and no traced behaviors indicating exfiltration, install-ti...

CVE-2026-53983

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...

MAL-2026-13459 Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...

MAL-2026-13411 Malicious code in @addai/node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca685518d56ea513609a2dfcd845bb14d94c3faaf58645553c688ca59817921 The package installs a background daemon dist/session-runner.js that pairs the host to a remote +Ai account and polls a hardcoded Supabase backend at...

MAL-2026-13409 Malicious code in @addai/ainode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261 After a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at...

Malicious code in @addai/ainode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f916e16183232b51c27001adf95092d7d88c09c23839715db72b129bdf22261 After a one-time pairing flow, the daemon in dist/session-runner.js and dist/command-runner.js polls a hardcoded Supabase project at...

Malicious code in agenthub-multiagent-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a agenthub-multiagent-mcp ships a worker dist/worker.js that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/ and, fo...

MAL-2026-13399 Malicious code in agenthub-multiagent-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a agenthub-multiagent-mcp ships a worker dist/worker.js that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/ and, fo...

MAL-2026-13403 Malicious code in streak-cache-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135 The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a...

Malicious code in streak-cache-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59c390b9379b870b37038a8ad8f52b179d2fce3aa38fc15e5d1c9dc3f0ece135 The package advertises itself as a dependency-free calendar-day bucketing / streak math library, but its main module dist/index.mjs contains a...

EUVD-2026-53818

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

CVE-2026-19019 poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...