Malicious code in neighbor-key-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1d780b9dd8236dfbb127579a5d58fac8423ea3992ce4900bf41abce906aae39 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sliding-score-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e2a97d5dd3e10080ee69201bf757ea14ebda90b9da1be41392584152ad1f1d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15892 Malicious code in priority-slot-queue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28d9070a4736fe0ceeb43d3f01cad7456582c802e6bb0f84ab6b4e1050947316 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in btree-lru-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6842cca5e4f00ee191865c33d73bef23be7df2e06f8157394532bb26d9749a42 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15874 Malicious code in btree-leaderboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ceaaf14d642f02835e10e1eb7de05ea911ecf2b72bc354305aa3d6bf874e4e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-15888 Malicious code in indexed-btree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcf3d23eb09d4a5d5736b43c78f6b140e79d23c0ac3488e84f3f1633c1ae578 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in element-guci-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e43ee355ab038085d87ed11e81acc53a50163f14b617d54b7e9b9c31e800900a Package is published as an element-ui utility library element-guci-util, description '元素-ui 常用工具函数集合' but its main entrypoint contains no utility...

MAL-2026-15882 Malicious code in element-utils-guci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86753bfc758ba4e9c2c759b41e85f2720f38585f5eb0bf42966dfdb7fab6ea59 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in google-internal-cloud-audit-security-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62a38a595d0fcf5e869dc2cdd939d476de1fbd24253eb6afd383c08c959dfc34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15842 Malicious code in google-internal-cloud-audit-security-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62a38a595d0fcf5e869dc2cdd939d476de1fbd24253eb6afd383c08c959dfc34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15833 Malicious code in apple-cktool-internal-api-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faeeff2b18d0a2f9f9a5d8d9543b6d950f49c64f6313b37fc02bc68aa9fd9d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15838 Malicious code in frank-apple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2074ea7bc8e4cebf5e583f23cb534632931139d702252dfc554b75bfb5866072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in frank-apple-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2074ea7bc8e4cebf5e583f23cb534632931139d702252dfc554b75bfb5866072 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apple-cktool-internal-api-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faeeff2b18d0a2f9f9a5d8d9543b6d950f49c64f6313b37fc02bc68aa9fd9d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-7MGC-C7PQ-3RR3 Grav: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge

Summary When 2FA is enabled on an account, submitting correct credentials authenticates the user but leaves them unauthorized pending TOTP verification. During this pending-challenge window, the login.regenerate2FASecret task which requires only $user-exists, not $user-authorized can be called...

credential-attacks-toolkit — Updated!

CredAttack — Credential Attacks Toolkit ⚠️ LEGAL NOTICE — Authorised security testing ONLY. Using this tool against systems you do not own or have explicit written permission to test is illegal under the Computer Fraud and Abuse Act US, Computer Misuse Act UK, and equivalent laws worldwide. See...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...

CVE-2026-84652

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me" cookie, allowing attackers able to serve content on the same site as Jenkins to set a known session cookie in the victim's browser, which after the victim...