Malicious code in rullzdigital-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bfc2bce31260b9826f9f3040d958f28d0229e8db4f0d7bec9bd9404f86fc5a4 The package rullzdigital-libsignal was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1164 Malicious code in yazxzpedia-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a15db837581bcddfd86653905bef2911ba017a109d3275551bb040e60b61794 The package yazxzpedia-libsignal was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1162 Malicious code in xpack-test-3.0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4fcebf35e85158afa53ce21da1265a4c3acac20914c4c76285d9043ac3a2d62 The package xpack-test-3.0 was found to contain malicious code. Source: ghsa-malware 825d559cd29d6d2efd0f89583e84f31a7b471bfbc3376252e71872d8f9863d87...

MAL-2026-1148 Malicious code in ethglobal-finale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08bdc506129e3fb599d1bb0f5c3a369199b3f58ecda5d8c869d47f25847da6ad The package ethglobal-finale was found to contain malicious code. Source: ghsa-malware 051d643dd2d78f5cfda5a7945e560297dae2d0d8abe72d2b1725846b34951f...

Malicious code in xpack-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62edc6bb089c839e93cf7b71b8b46ca1f5d064272cac586b49cda41fc40b1c19 The package xpack-subscription was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1160 Malicious code in xpack-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62edc6bb089c839e93cf7b71b8b46ca1f5d064272cac586b49cda41fc40b1c19 The package xpack-subscription was found to contain malicious code. Source: ghsa-malware...

OpenClaw: Config writes could persist resolved ${VAR} secrets to disk

Summary OpenClaw hooks previously compared the provided hook token using a regular string comparison. Because this comparison is not constant-time, an attacker with network access to the hooks endpoint could potentially use timing measurements across many requests to gradually infer the token. In...

Malicious code in @nazi-team/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe057f6743744866cb43bc64a47f0b4e814f4de1d503ea59e8b3db6b3880ad00 The package @nazi-team/baileys was found to contain malicious code. Source: ghsa-malware...

Malicious code in @nazi-team/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35d42b676cf5fb92b36d77c6e032bdf4ebfda10a9fa26fa93be2d45a7e665ad8 The package @nazi-team/libsignal-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1119 Malicious code in @nazi-team/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe057f6743744866cb43bc64a47f0b4e814f4de1d503ea59e8b3db6b3880ad00 The package @nazi-team/baileys was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1115 Malicious code in chai-vest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b92343f543acb60949d618ec06160013b1536a63f3db5431a4e24b1eaac2ccae The package chai-vest was found to contain malicious code. Source: ghsa-malware 2d3a82ac6f8ebd7b7eba324f04e78d43fccef2f3ddf20c24014f4768dc50731d Any...

CLSA-2026-1772456640 podman: Fix of 4 CVEs

rebuild with newer golang version 1.22.9-1.el92.tuxcare.els6 to fix the following CVE's - CVE-2025-68121: fix TLS session resumption bypass by preventing shared auto-rotated ticket keys in Config and validating full certificate chain expiry - CVE-2025-61726: limit parsed URL query parameters to...

Malicious code in typoriem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e473ba3785bff62ce2994c6f09309570eea69282acc5438f015d85ca0e61cf5c The package typoriem was found to contain malicious code. Source: ghsa-malware 4dfd9fb9cb096af0fd4d1db216d08d1ae5592ef63c0c97c66a491b00ebdde43e Any...

MAL-2026-1110 Malicious code in loadash-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8a6b55079998d38c9458ab6cae73e677bccc96d3965a9e6584e85c0450c2695 The package loadash-lint was found to contain malicious code. Source: ghsa-malware 9ad2a23ceb26c4b6ac051ac94acfa976eda403c11d9eaf9833d2b9206a5d2155 A...

MAL-2026-1104 Malicious code in bubble-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bac16503e5a840ccf7e88977f38fac02affaa1c8eaff7f449b9832fa03cbd0a8 The package bubble-core was found to contain malicious code. Source: ghsa-malware a4122cb6b21018902fe682cf3dd31246d52f8850e8116649894d89df6f06acb2 An...

MAL-2026-1107 Malicious code in formmiderable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a421f6bd77d5bfcd4d08aaedcffd8b55c430c85084ccce52372a6700eaac6d50 The package formmiderable was found to contain malicious code. Source: ghsa-malware 5d9ce26e5d5c2d433753869317d12725c4dfdb05728a86f4acf96b75f8d16d50...

MAL-2026-1078 Malicious code in socket-dgxeon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b1cdce1957669bd7cca7bb7c90b018a87fad6ed9ea49b4874f127272f0c00d The package socket-dgxeon was found to contain malicious code. Source: ghsa-malware 0f36366d3dd38134f3c8176992483c8c67f2e502ca9b774a4ea5a3fc2d428efc...

Malicious code in dgxeon-soket4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c38e017a1a49fe2e8fa61441a0f35d77a1b7052475fffefecca2fa4248a54c58 The package dgxeon-soket4 was found to contain malicious code. Source: ghsa-malware 1efad9e444be88f0b8912153564d4feb2b0dff3063ec3bb5f0750731faec1057...

Malicious code in dgxeon-soket2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 833766a284022eb1ea516ee081a4cec3c5153b1bbec222238d7e676876acf10c The package dgxeon-soket2 was found to contain malicious code. Source: ghsa-malware d7bc58675189e4ecaf6f63610f5f5a05aebb80d0f3cb8bd1247fc9876a7bd13b...

CVE-2026-27465

Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s configuration API could expose Google Calendar service account credentials to authenticated users with low-privilege roles. This may allow unauthorized access to Google Calendar resources...