Malicious code in tutor_table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d11a723f74a2369662e6322495f50a32bdb5dbb2d2022b1c44c55e2e3a8738d3 The package tutortable was found to contain malicious code. Source: ghsa-malware 3e6e46b475e720d998048f0eb1d07e6d3aef827537e27d7fc205902884be9aba Any...

Malicious code in internallib_v355 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dba9a4166fd959eea5357952f1ffba736b4e6c9176ddeff85e0aeb1592edef8 The package internallibv355 was found to contain malicious code. Source: ghsa-malware 41e49779a105339cef2addb161d2a79d3aa2e22201f862ba6c3ef2af1ab1ccd...

Malicious code in internal-company-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa8dfa7267565b0ac4a94eb2d7fda38475a0ff412b196f5bdc842e73f9671455 The package internal-company-sdk was found to contain malicious code. Source: ghsa-malware...

Malicious code in ofjaaah-auth-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 680db6543dbee7ec4f8cfe557fc5c76a13bb684b7faeec4e6e2582c0d89ecdf7 The package ofjaaah-auth-module was found to contain malicious code. Source: ghsa-malware...

Malicious code in private-payment-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c4346497d58e1d5eca5c47353d4491578827b6095eb0f62dc7ff4449c0758b The package private-payment-lib was found to contain malicious code. Source: ghsa-malware...

Malicious code in ofjaaah-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0f994ed6a23b4449a3ab09537485788c488a90e26c56c52d309b4704d8d2da9 The package ofjaaah-build-tools was found to contain malicious code. Source: ghsa-malware...

MAL-2026-342 Malicious code in ofjaaah-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0f994ed6a23b4449a3ab09537485788c488a90e26c56c52d309b4704d8d2da9 The package ofjaaah-build-tools was found to contain malicious code. Source: ghsa-malware...

MAL-2026-338 Malicious code in internal-company-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa8dfa7267565b0ac4a94eb2d7fda38475a0ff412b196f5bdc842e73f9671455 The package internal-company-sdk was found to contain malicious code. Source: ghsa-malware...

MAL-2026-345 Malicious code in private-payment-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c4346497d58e1d5eca5c47353d4491578827b6095eb0f62dc7ff4449c0758b The package private-payment-lib was found to contain malicious code. Source: ghsa-malware...

CVE-2025-59870

HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk...

CVE-2025-68671

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...

CVE-2025-59870

HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk...

CVE-2025-59870

HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk...

CVE-2025-59870

HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk...

CVE-2025-59870 Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk

HCL MyXalytics v6.7 is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk...

CVE-2025-59870 Improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk

HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk...

PT-2026-3243

Name of the Vulnerable Software and Affected Versions HCL MyXalytics version 6.7 Description The web application does not rotate the JWT signing secret, resulting in improper management of a static secret. This introduces a security risk. Recommendations Rotate the JWT signing secret in the web...

HCL MyXalytics security vulnerabilities

HCL MyXalytics is an analytical software product developed by the Indian company HCL. It is used for data analysis and related tasks. Version HCL MyXalytics v6.7 contains a security vulnerability. This vulnerability stems from improper management of the static JWT signature key and lack of...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack via the authentication process in the S3 gateway. An attacker can gain unauthorized access or perform actions by replaying previously captured signed requests, as the system does not validate timestamps on authenticated...

CVE-2025-68671

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated requests, allowing replay attacks. Prior to 1.75.0, an attacker who captures a valid signed request e.g., through network interception, logs...