MAL-2026-11461 Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

EUVD-2026-51568

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

Malicious code in vite-tsconfig-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...

MAL-2026-11497 Malicious code in vite-tsconfig-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a42a11a98297070648c64645be52ca20e8c0f7c0d6fb00a51e921a368c71c4e1 index.js contains two base64 constants that decode to the shell command npm install rollup-plugin-polyfill-helper --no-save --silent --no-audit...

Malicious code in rollup-plugin-polyfill-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...

MAL-2026-11479 Malicious code in rollup-plugin-polyfill-hold (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57956044a2c40ab32e789cd46c26ab03304478179d15897f97c29d12cc838e8a The package presents itself as a rollup plugin / CDN icon-asset fetcher but its exported getPlugin, setPlugin, and getPluginExten functions issue HTT...

Malicious code in @0xlr/question-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f892cd190720c7c8f07109cfcbdd37f66caf5065ba5667b5be0800813dc0cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...

Malicious code in @0xlr/dep-confusion-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...

MAL-2026-11431 Malicious code in @0xlr/dep-confusion-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15016319bdfd6f98a13cf4dcca7adad8ad4a97678bfaa77e2cb9b7068be0a435 Self-described dependency-confusion proof-of-concept targeting the @gojek/argus internal scope name. The package's postinstall hook only runs echo...

MAL-2026-11433 Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...

MAL-2026-11496 Malicious code in vite-config-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee541a67169360e2d9ac3da7d19353031dd395c5e1bbe05bb4540ccc4837fa3 The package's exported getPlugin/setPlugin functions, when invoked by a consumer, decode base64-obfuscated string constants svgValidateKey,...

MAL-2026-11478 Malicious code in rollup-plugin-polyfill-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26ffb29f08934ff71707ec249cb3572812636676d81be362b826ab0db54b5d1 Package presents itself as a rollup plugin for CDN SVG icons, but its exported functions getPlugin/setPlugin/getPluginExten issue an HTTP request to ...

Malicious code in @peptide-packets/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0bc181dc4391ee3b974bfa8ec4aafcf982c6bae5f7d9e6850d03d25293cca6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11447 Malicious code in @peptide-packets/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdbac126c4dd058b5bbdeaf3b962acf9e6adce490c77b90545db33b97a878082 index.js in @peptide-packets/js-unimode exposes a listMods function that decodes a base64-encoded URL pointing to a GitHub gist owned by user...

Malicious code in @peptide-packets/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdbac126c4dd058b5bbdeaf3b962acf9e6adce490c77b90545db33b97a878082 index.js in @peptide-packets/js-unimode exposes a listMods function that decodes a base64-encoded URL pointing to a GitHub gist owned by user...

SUSE CVE-2025-11794

Mattermost versions 10.11.x = 10.11.3, 10.5.x = 10.5.11, 10.12.x = 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secrets via the POST /api/v4/users/userid/email/verify/member endpoint...