EUVD-2026-33273

Mautic Focus component Vulnerable to SSRF...

Malicious code in date-fns-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4694a079d83e33dcee7f87140c41737009d9f0b19f351c23f2ae3dbce9a47a51 [email protected] presents as a lightweight date-formatting utility but ships a malicious postinstall.js that runs automatically on npm install. T...

The Gentlemen are knocking: сustom backdoors and evolving tactics

Introduction This year saw the emergence of The Gentlemen, a prominent example of a group operating under the ransomware-as-a-service RaaS model. Although our initial assessment suggested the group first appeared in mid-2025, it actually started ramping up its activities at the beginning of 2026...

Malicious code in ledgerflow-deploy-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0097d19be676ac30ff79dffcff38f128873c80115a8a150c3eceff0422aa93 On npm install, the package's postinstall script queries the AWS instance metadata service IMDSv1 at 169.254.169.254 for the attached IAM role and...

MAL-2026-6591 Malicious code in ledgerflow-deploy-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0097d19be676ac30ff79dffcff38f128873c80115a8a150c3eceff0422aa93 On npm install, the package's postinstall script queries the AWS instance metadata service IMDSv1 at 169.254.169.254 for the attached IAM role and...

MAL-2026-6577 Malicious code in int_sezzle_sfra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16242285e7dabb5a109f61e97ab52c05ad80ea9b8f326a706c3228268536e80d package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects host reconnaissance from the installer...

MAL-2026-6571 Malicious code in react-wp-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 443f37b7957fe3f1d4dd836b3a0e6eeddb513e334700e0c0a4616570071c13d8 react-wp-viewer 0.2.4 is a dependency-confusion package. Its postinstall hook performs an HTTP GET to a hardcoded bare-IP endpoint at...

MAL-2026-6511 Malicious code in hydanlabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92288b41a62d25886b2aafe73ced1054249d215d131bb4d7e5e2353e1f1a3b5f The CLI hardcodes its LLM backend to a bare-IP, plain-HTTP endpoint http://151.244.40.74:4000 controlled by the package author. Every request POSTs a...

GO-2026-5716 Kubewarden vulnerable to RBAC Reconnaissance via unchecked can_i host capability call in github.com/kubewarden/kubewarden-controller

Kubewarden vulnerable to RBAC Reconnaissance via unchecked cani host capability call in github.com/kubewarden/kubewarden-controller...

MAL-2026-6463 Malicious code in abu-common-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17e7b4ac8a492915d8475c73488b64236250746de410c705b7cc43c0656589be package.json declares preinstall and postinstall hooks that invoke curl against a hardcoded bare-IP HTTP endpoint...

pentest-metasploit

Penetration Testing with Metasploit A structured penetration...

Malicious code in markdownlint-cli2-fix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca7d5154ecbbcc636198bd2314e1916e5f0673d37ab7b14caca2ea96ad5ac5e1 Package name 'markdownlint-cli2-fix' impersonates the popular 'markdownlint-cli2' linter but contains no linter functionality — the README states...

MAL-2026-6352 Malicious code in hex-conv-ae7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d4f6adb1ef40a529deec65b7409b949cd93ad60d6cf3880ff5e8f0079fef1f The package's package.json declares a postinstall hook "postinstall": "node run.js" that runs run.js automatically on npm install. run.js imports os,...

AryStinger Malware Infects 4,300 Legacy Routers to Build Reconnaissance Proxy Network

A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. QiAnXin's XLab calls it AryStinger and counts at least 4,300 infected routers, a total it says is still rising. The distinction matters...

MAL-2026-6131 Malicious code in computerrock-babel-preset-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8987a1638ceebfb3dc8c8fc29e8e696fa15c6fe667697dfc367f59bf56b14cfa The package impersonates the well-known babel-preset-react-app under a fake org-style prefix and ships no Babel preset code. package.json declares...

CVE-2026-12539

Docker Sandboxes sbx blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat...

CVE-2026-12539 Docker Sandboxes ICMP egress restriction bypass after daemon restart

Docker Sandboxes sbx blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat...

MAL-2026-6099 Malicious code in stream-read-35cf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0597f71a1c39a743a4323636794601b480a1cda0c64df20d6bafa7ed601da84e Package declares a postinstall hook "postinstall": "node run.js" that auto-executes run.js on npm install. run.js imports os, fs, http, https, and...

MAL-2026-6086 Malicious code in ai-chat-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a12d35a8713a8f63eaf342901214a7f53fa396b9ee8218d246e5e0db7b6318 collect.js performs system reconnaissance and exfiltration to a hardcoded attacker-controlled host. The script imports childprocess, os, fs, http, an...

Malicious code in metrics-probe-64b2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae901b673ee21724897f69c782eb2808c55c2722bacc9912a4a3e60f7019883 package.json declares a postinstall hook "postinstall": "node run.js" that executes run.js automatically on every npm install. run.js imports os, fs,...