Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...

MSC-2026-11340

Coordinated dependency-confusion wave on npm: 21 packages published 2026-08-12 under bin names exposed by Google-affiliated scoped packages @angular/, @bazel/, @google/, @googlemaps/, @tensorflow/ that had never been registered as standalone names. Each package ships nothing but a package.json...

Malicious code in bjm-low-code-components (npm)

Source: amazon-inspector f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b On npm install, the package's postinstall hook runs canary.js, which collects the installer's hostname, username, current working directory, and selected environment variables and POSTs them over plain HTTP ...

Malicious code in bjm-low-code-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b On npm install, the package's postinstall hook runs canary.js, which collects the installer's hostname, username, current working directory, and...

MAL-2026-13751 Malicious code in bjm-low-code-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f47bf808132c7ac7ba3324f1e4dec6932c64eabb78e1030ce613267ea9a3cf5b On npm install, the package's postinstall hook runs canary.js, which collects the installer's hostname, username, current working directory, and...

MAL-2026-13744 Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2284b9966871244eb99dd61230f6b17e6b2fb315484fb2b3048c51a780820a1f The package's postinstall script POSTs installer metadata package name/version, platform, arch, Node version, timestamp over plain HTTP to a hardcode...

Malicious code in @dgn-src-click-to-pay-org/srcdcfreleasecert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2284b9966871244eb99dd61230f6b17e6b2fb315484fb2b3048c51a780820a1f The package's postinstall script POSTs installer metadata package name/version, platform, arch, Node version, timestamp over plain HTTP to a hardcode...

Malicious code in zeal-rq-hooks (npm)

Source: amazon-inspector dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164 The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname, os.userInfo, process.platform, node/npm version, and cwd to the hardcoded endpoint...

MAL-2026-13742 Malicious code in zeal-rq-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164 The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname, os.userInfo, process.platform,...

Malicious code in zeal-rq-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf7e926ec85f72f362263a19d4f99c4b215ddd94ed4454c669c3387cacee164 The package includes canary.js which imports os/http/https and, at line 123, POSTs a JSON body containing os.hostname, os.userInfo, process.platform,...

CVE-2026-18348

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348

Velociraptor CVE-2026-18348 involves missing authorization checks in the upload_azure, upload_sftp, and upload_smb VQL plugins. An authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL boundary. This c...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

Malicious code in @noobaihome/amis-uni-area-widget (npm)

Source: amazon-inspector 1741a7c8b780801766382499022f9aa860eb8313e4a416a5157afeb9a92f6561 scripts/install.js runs during npm preinstall and performs three attacker-beneficial actions against the installer host. First, it unconditionally beacons installer identifiers pid, base64-encoded process.cw...

Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

nerva v1.64.3

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...

Malicious code in titan-exchange-shared-permissions (npm)

Source: amazon-inspector 248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6 [email protected] is a dependency-confusion reconnaissance package. package.json declares a postinstall script node index.js that runs automatically on npm install; index.js collects t...

Malicious code in atlas-internal (PyPI)

Source: amazon-inspector cdd4a17504623add1ff4f374ea9c2283d1eb5a863265e012592142b169cd9d90 setup.py overrides the egginfo command to execute automatically during pip install. The overridden command collects the installer's hostname, current working directory, and OS username, URL-encodes them, and...